CVE-2022-23471

CVSS V2 None CVSS V3 None
Description
containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.
Overview
  • CVE ID
  • CVE-2022-23471
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-12-07T23:15:09
  • Last Modified Date
  • 2022-12-12T14:53:58
Weakness Enumerations
CWE URL
CWE-400 http://cwe.mitre.org/data/definitions/400.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* 1 OR 1.5.16
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* 1 OR 1.6.0 1.6.12
References
Reference URL Reference Tags
https://github.com/containerd/containerd/commit/a05d175400b1145e5e6a735a6710579d181e7fb0
https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j-52j9
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-23471
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23471
History
Created Old Value New Value Data Type Notes
2022-12-07 23:41:27 Added to TrackCVE
2022-12-08 01:04:18 2022-12-07T23:15:09.763 2022-12-07T23:15:09 CVE Published Date updated
2022-12-08 01:04:18 2022-12-08T00:08:13 CVE Modified Date updated
2022-12-08 01:04:18 Received Awaiting Analysis Vulnerability Status updated
2022-12-11 07:14:57 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2022-12-12 15:15:25 2022-12-12T14:53:58 CVE Modified Date updated
2022-12-12 15:15:25 Undergoing Analysis Analyzed Vulnerability Status updated
2022-12-12 15:15:27 CPE Information updated