CVE-2022-31030 — Uncontrolled Resource Consumption in Containerd

CWE-400 — Uncontrolled Resource Consumption11 documents7 sources
Severity
5.5MEDIUMNVD
OSV6.5
EPSS
0.2%
top 63.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
ContainerdGithub.com Containerd ContainerdLinuxfoundation Containerd+2 more
Timeline
PublishedJun 9
Latest updateAug 21

Description

containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDlinuxfoundation/containerd1.6.0 — 1.6.6+1
▶CVEListV5containerd/containerd< 1.5.13+1
▶Gogithub.com/containerd_containerd1.6.0 — 1.6.6+1
▶Debiancontainerd/containerd< 1.4.13~ds1-1~deb11u2+3
▶Ubuntucontainerd/containerd< 1.5.9-0ubuntu1~18.04.2+2

Also affects: Debian Linux 11.0, Fedora 35, 36

🔴Vulnerability Details

6
OSV
containerd CRI plugin: Host memory exhaustion through ExecSync in github.com/containerd/containerd↗2024-08-21
▶
OSV
containerd vulnerabilities↗2022-12-13
▶
OSV
CVE-2022-31030: containerd is an open source container runtime↗2022-06-09
▶
CVEList
containerd CRI plugin: Host memory exhaustion through ExecSync↗2022-06-06
▶
OSV
containerd CRI plugin: Host memory exhaustion through ExecSync↗2022-06-06
▶

📋Vendor Advisories

4
Ubuntu
containerd vulnerabilities↗2022-12-13
▶
Ubuntu
containerd vulnerabilities↗2022-07-15
▶
Microsoft
containerd CRI plugin: Host memory exhaustion through ExecSync↗2022-06-14
▶
Debian
CVE-2022-31030: containerd - containerd is an open source container runtime. A bug was found in the container...↗2022
▶
CVE-2022-31030 — Uncontrolled Resource Consumption | cvebase