CVE-2022-31030

CVSS V2 Low 2.1 CVSS V3 Medium 5.5
Description
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.
Overview
  • CVE ID
  • CVE-2022-31030
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-06-09T14:15:08
  • Last Modified Date
  • 2022-11-29T16:40:29
Weakness Enumerations
CWE URL
CWE-400 http://cwe.mitre.org/data/definitions/400.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* 1 OR 1.5.13
cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* 1 OR 1.6.0 1.6.6
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:N/I:N/A:P
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 2.1
  • Severity
  • LOW
  • Exploitability Score
  • 3.9
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • NONE
  • Availability Impact
  • HIGH
  • Base Score
  • 5.5
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 1.8
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
http://www.openwall.com/lists/oss-security/2022/06/07/1 Mailing List Third Party Advisory
https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382 Product Third Party Advisory
https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REOZCUAPCA7NFDWYBDYX6EYXWLHABKBO/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WSIGDBHAB3I75JBJNGWEPBTJPS2FOVHD/
https://www.debian.org/security/2022/dsa-5162 Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-31030
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31030
History
Created Old Value New Value Data Type Notes
2022-06-09 15:00:13 Added to TrackCVE
2022-12-06 14:32:37 2022-11-29T16:40:29 CVE Modified Date updated
2022-12-06 14:32:37 Undergoing Analysis Analyzed Vulnerability Status updated