Read the docs
TI-2022-01574 Aliases CVE-2022-1708GHSA-fcm2-6c3h-pg6j

Uncontrolled resource consumption in CRI-O

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

Why it matters now

EPSS 0.03165 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/cri-o/cri-o (Go): 1.24.1, 1.23.3, 1.22.5Red Hat: 9 advisoriesRed Hat: 7 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—CRI-OAffects cri-o <= 1.24.0, 1.23.2, 1.22.4, Fixed-in 1.24.1, 1.23.3, 1.22.5—No fix listedCNA
—github.com/cri-o/cri-o (Go)1.24.0 to before 1.24.11.24.1Patch availableGHSA-fcm2-6c3h-pg6j
—github.com/cri-o/cri-o (Go)1.23.0 to before 1.23.31.23.3Patch availableGHSA-fcm2-6c3h-pg6j
—github.com/cri-o/cri-o (Go)before 1.22.51.22.5Patch availableGHSA-fcm2-6c3h-pg6j
  • CRI-O Vendor— Affected Affects cri-o <= 1.24.0, 1.23.2, 1.22.4, Fixed-in 1.24.1, 1.23.3, 1.22.5 Fixed in — No fix listed CNA
  • github.com/cri-o/cri-o (Go) Vendor— Affected 1.24.0 to before 1.24.1 Fixed in 1.24.1 Patch available GHSA-fcm2-6c3h-pg6j
  • github.com/cri-o/cri-o (Go) Vendor— Affected 1.23.0 to before 1.23.3 Fixed in 1.23.3 Patch available GHSA-fcm2-6c3h-pg6j
  • github.com/cri-o/cri-o (Go) Vendor— Affected before 1.22.5 Fixed in 1.22.5 Patch available GHSA-fcm2-6c3h-pg6j

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:*before 1.19.7; 1.20.0 to before 1.20.8; 1.21.0 to before 1.21.8; 1.22.0 to before 1.22.5; 1.23.0 to before 1.23.3VulnerableKubernetes
cpe:2.3:a:kubernetes:cri-o:1.24.0:*:*:*:*:*:*:*1.24.0VulnerableKubernetes
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:*4.9VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0VulnerableRed Hat
  • cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:* Versions before 1.19.7; 1.20.0 to before 1.20.8; 1.21.0 to before 1.21.8; 1.22.0 to before 1.22.5; 1.23.0 to before 1.23.3 Vulnerable ·Kubernetes
  • cpe:2.3:a:kubernetes:cri-o:1.24.0:*:*:*:*:*:*:* Versions 1.24.0 Vulnerable ·Kubernetes
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-fcm2-6c3h-pg6j github.com/cri-o/cri-o (Go) Fixed in 1.24.1 Advisory →
  • Fix · GHSA-fcm2-6c3h-pg6j github.com/cri-o/cri-o (Go) Fixed in 1.23.3 Advisory →
  • Fix · GHSA-fcm2-6c3h-pg6j github.com/cri-o/cri-o (Go) Fixed in 1.22.5 Advisory →

Red Hat 9 advisories

  • RHSA-2022:7469 Released 2022-11-08 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.s390x::container-tools:4.0 +47
  • RHSA-2022:7529 Released 2022-11-08 · Red Hat rating Moderate
    container-tools:3.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.aarch64::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.ppc64le::container-tools:3.0, buildah-1.19.9-6.module+el8.7.0+16212+65e1b35f.s390x::container-tools:3.0 +47
  • RHSA-2022:7457 Released 2022-11-08 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.aarch64::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.ppc64le::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.s390x::container-tools:rhel8 +47
Show 6 more Red Hat advisories
  • RHSA-2022:4999 Released 2022-06-21 · Red Hat rating Moderate
    OpenShift Container Platform 3.11.715 packages and security update
    • Red Hat OpenShift Container Platform 3.11 cri-o-1.11.16-0.17.rhaos3.11.git4c0a8ad.el7
  • RHSA-2022:4947 Released 2022-06-17 · Red Hat rating Important
    OpenShift Container Platform 4.6.59 security update
    • Red Hat OpenShift Container Platform 4.6 conmon-2:2.0.21-3.rhaos4.6.el7, conmon-2:2.0.21-3.rhaos4.6.el8, cri-o-1.19.7-2.rhaos4.6.git3c20b65.el7 +2
  • RHSA-2022:4951 Released 2022-06-16 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.43 packages and security update
    • Red Hat OpenShift Container Platform 4.8 conmon-2:2.0.29-3.rhaos4.8.el7, conmon-2:2.0.29-3.rhaos4.8.el8, cri-o-1.21.8-3.rhaos4.8.gitd7fbb0d.el7 +1
  • RHSA-2022:4965 Released 2022-06-16 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.53 packages and security update
    • Red Hat OpenShift Container Platform 4.7 conmon-2:2.0.29-3.rhaos4.7.el7, conmon-2:2.0.29-3.rhaos4.7.el8, cri-o-1.20.8-3.rhaos4.7.gitb9df556.el7 +1
  • RHSA-2022:4972 Released 2022-06-14 · Red Hat rating Moderate
    OpenShift Container Platform 4.9.38 packages and security update
    • Red Hat OpenShift Container Platform 4.9 conmon-2:2.0.29-3.rhaos4.9.el7, conmon-2:2.0.29-3.rhaos4.9.el8, cri-o-1.22.5-3.rhaos4.9.gitb6d3a87.el7 +1
  • RHSA-2022:4943 Released 2022-06-13 · Red Hat rating Moderate
    OpenShift Container Platform 4.10.18 packages and security update
    • Red Hat OpenShift Container Platform 4.10 conmon-2:2.0.29-3.rhaos4.10.el8, cri-o-1.23.3-3.rhaos4.10.git5fe1720.el8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7457, RHSA-2022:7469, RHSA-2022:7529
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2022:4999
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:4943
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2022:4947
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2022:4965
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2022:4951
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2022:4972
Not affected: 6 products
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat OpenShift Container Platform 4.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1708
  2. 2026-10-03 Alias added: GHSA-fcm2-6c3h-pg6j

References

Exploit 1

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences