PT-2022-6020 · Containerd+7 · Kubernetes Containerd+6

Samuelkarp · Published 2022-12-07 · Updated 2024-09-10 · CVE-2022-23471

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions containerd versions prior to 1.6.12 containerd versions prior to 1.5.16

Description A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO.

Recommendations For versions prior to 1.6.12, update to version 1.6.12 to resolve the issue. For versions prior to 1.5.16, update to version 1.5.16 to resolve the issue. For users unable to upgrade, ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.

Exploit

Fix

Resource Exhaustion

Memory Leak

Weakness Enumeration

CWE-400

CWE-401

Related Identifiers

ALT-PU-2022-3370

ALT-PU-2023-1489

ALT-PU-2024-12206

AZL-11585

BDU:2022-07471

CVE-2022-23471

GHSA-2QJP-425J-52J9

GO-2022-1147

MGASA-2023-0245

OESA-2022-2143

OPENSUSE-SU-2022_4463-1

OPENSUSE-SU-2024:12558-1

SUSE-SU-2022:4409-1

SUSE-SU-2022:4463-1

SUSE-SU-2022_4409-1

SUSE-SU-2022_4463-1

SUSE-SU-2023:1566-1

SUSE-SU-2023:1628-1

SUSE-SU-2023_1566-1

SUSE-SU-2023_1628-1

USN-5776-1

Affected Products

Alt Linux

Astra Linux

Kubernetes Containerd

Linuxmint

Red Os

Suse

Ubuntu

References · 53

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23471.json · Exploit
• https://github.com/containerd/containerd/commit/a05d175400b1145e5e6a735a6710579d181e7fb0 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/7KYYYEETR5DEGOQBCMLUC4OEN4O3JGKF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23471 · Security Note
• https://osv.dev/vulnerability/GHSA-2qjp-425j-52j9 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1628-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5776-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23471 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6202-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31030 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23471 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23471 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1566-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23471 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23471 · Vendor Advisory