CVE-2022-23471 — Uncontrolled Resource Consumption in Containerd

CWE-400 — Uncontrolled Resource ConsumptionCWE-401 — Missing Release of Memory after Effective Lifetime10 documents7 sources
Severity
6.5MEDIUMNVD
CNA5.7
EPSS
0.2%
top 52.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
ContainerdGithub.com Containerd ContainerdLinuxfoundation Containerd
Timeline
PublishedDec 7
Latest updateAug 21

Description

containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementati…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶NVDlinuxfoundation/containerd1.6.0 — 1.6.12+1
▶CVEListV5containerd/containerd< 1.5.16+1
▶Gogithub.com/containerd_containerd1.6.0 — 1.6.12+1
▶Debiancontainerd/containerd< 1.4.13~ds1-1~deb11u3+3
▶Ubuntucontainerd/containerd< 1.5.9-0ubuntu1~18.04.2+2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

6
OSV
containerd CRI stream server vulnerable to host memory exhaustion via terminal in github.com/containerd/containerd↗2024-08-21
▶
OSV
containerd vulnerabilities↗2022-12-13
▶
OSV
containerd CRI stream server vulnerable to host memory exhaustion via terminal↗2022-12-07
▶
CVEList
containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak↗2022-12-07
▶
GHSA
containerd CRI stream server vulnerable to host memory exhaustion via terminal↗2022-12-07
▶

📋Vendor Advisories

3
Ubuntu
containerd vulnerabilities↗2022-12-13
▶
Microsoft
containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak↗2022-12-13
▶
Debian
CVE-2022-23471: containerd - containerd is an open source container runtime. A bug was found in containerd's ...↗2022
▶
CVE-2022-23471 — Uncontrolled Resource Consumption | cvebase