Containerd < 1.7.35 / 2.0.x < 2.0.12 / 2.2.x < 2.2.8 / 2.3.x < 2.3.5 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347978);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-53495");
  script_xref(name:"IAVA", value:"2026-A-1024");

  script_name(english:"Containerd < 1.7.35 / 2.0.x < 2.0.12 / 2.2.x < 2.2.8 / 2.3.x < 2.3.5 DoS");

  script_set_attribute(attribute:"synopsis", value:
"The container runtime installed on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Containerd on the remote host is prior to 1.7.35, 2.0.x prior to 2.0.12, 2.2.x prior to 2.2.8, or 2.3.x
prior to 2.3.5. It is, therefore, affected by a denial of service vulnerability. containerd on Linux with the CRI plugin
enabled can indefinitely block the drainExecSyncIO goroutine when CRI ExecSync is used by exec probes or lifecycle hooks
that launch long-lived background child processes retaining standard input and output pipes. The input and output drain
phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations
can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to
terminate containerd, leaving the container runtime unavailable until restart.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?21ad2d74");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Containerd version 1.7.35, 2.0.12, 2.2.8, 2.3.5 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-53495");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:linuxfoundation:containerd");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("containerd_installed.nbin");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'containerd', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
          {'fixed_version': '1.7.35'},
          {'min_version': '2.0.0', 'fixed_version': '2.0.12'},
          {'min_version': '2.2.0', 'fixed_version': '2.2.8'},
          {'min_version': '2.3.0', 'fixed_version': '2.3.5'}
      ]
    }
  ]
};
var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);