CVE-2022-31030

Published: 9 June 2022

containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
containerd Launchpad, Ubuntu, Debian	bionic	Released (1.5.9-0ubuntu1~18.04.2)
	focal	Released (1.5.9-0ubuntu1~20.04.6)
	impish	Ignored (reached end-of-life)
	jammy	Released (1.5.9-0ubuntu3.1)
	kinetic	Released (1.6.4-0ubuntu1.1)
	upstream	Released (1.6.6~ds1-1)
	xenial	Released (1.2.6-0ubuntu1~16.04.6+esm2)

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›