CVE-2022-31030

2022-06-0900:00:00

ubuntu.com

containerd

cri

memory consumption

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

14.2%

JSON

containerd is an open source container runtime. A bug was found in the
containerd’s CRI implementation where programs inside a container can cause
the containerd daemon to consume memory without bound during invocation of
the ExecSync API. This can cause containerd to consume all available
memory on the computer, denying service to other legitimate workloads.
Kubernetes and crictl can both be configured to use containerd’s CRI
implementation; ExecSync may be used when running probes or when
executing processes via an “exec” facility. This bug has been fixed in
containerd 1.6.6 and 1.5.13. Users should update to these versions to
resolve the issue. Users unable to upgrade should ensure that only trusted
images and commands are used.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchcontainerd< 1.5.9-0ubuntu1~18.04.2UNKNOWN
ubuntu20.04noarchcontainerd< 1.5.9-0ubuntu1~20.04.6UNKNOWN
ubuntu22.04noarchcontainerd< 1.5.9-0ubuntu3.1UNKNOWN
ubuntu22.10noarchcontainerd< 1.6.4-0ubuntu1.1UNKNOWN
ubuntu16.04noarchcontainerd< 1.2.6-0ubuntu1~16.04.6+esm2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	containerd	< 1.5.9-0ubuntu1~18.04.2	UNKNOWN
ubuntu	20.04	noarch	containerd	< 1.5.9-0ubuntu1~20.04.6	UNKNOWN
ubuntu	22.04	noarch	containerd	< 1.5.9-0ubuntu3.1	UNKNOWN
ubuntu	22.10	noarch	containerd	< 1.6.4-0ubuntu1.1	UNKNOWN
ubuntu	16.04	noarch	containerd	< 1.2.6-0ubuntu1~16.04.6+esm2	UNKNOWN