containerd CRI plugin: Host memory exhaustion through ExecSync
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| backstage | containerd | before 1.5.13; 1.6.0 to before 1.6.6 | 1.5.13, 1.6.6 | Patch available | CNA |
| — | github.com/containerd/containerd (Go) | before 1.5.13 | 1.5.13 | Patch available | GHSA-5ffw-gxpp-mxpf |
| — | github.com/containerd/containerd (Go) | 1.6.0 to before 1.6.6 | 1.6.6 | Patch available | GHSA-5ffw-gxpp-mxpf |
- containerd Vendorbackstage Affected before 1.5.13; 1.6.0 to before 1.6.6 Fixed in 1.5.13, 1.6.6 Patch available CNA
- github.com/containerd/containerd (Go) Vendor— Affected before 1.5.13 Fixed in 1.5.13 Patch available GHSA-5ffw-gxpp-mxpf
- github.com/containerd/containerd (Go) Vendor— Affected 1.6.0 to before 1.6.6 Fixed in 1.6.6 Patch available GHSA-5ffw-gxpp-mxpf
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* | before 1.5.13; 1.6.0 to before 1.6.6 | Vulnerable | backstage |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
- cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:* Versions before 1.5.13; 1.6.0 to before 1.6.6 Vulnerable ·backstage
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA containerd (containerd) Fixed in 1.5.13, 1.6.6
- Fix · GHSA-5ffw-gxpp-mxpf github.com/containerd/containerd (Go) Fixed in 1.5.13 Advisory →
- Fix · GHSA-5ffw-gxpp-mxpf github.com/containerd/containerd (Go) Fixed in 1.6.6 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31030
- 2026-10-03 Alias added: GHSA-5ffw-gxpp-mxpf
References
Advisory 8
- https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf
- https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382
- [oss-security] 20220606 CVE-2022-31030: containerd CRI plugin: Host memory exhaustion through ExecSync
- DSA-5162
- FEDORA-2022-725ac93b48
- FEDORA-2022-1da581ac6d
- GLSA-202401-31
- https://nvd.nist.gov/vuln/detail/CVE-2022-31030
Other 5
- https://github.com/containerd/containerd
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/REOZCUAPCA7NFDWYBDYX6EYXWLHABKBO
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSIGDBHAB3I75JBJNGWEPBTJPS2FOVHD
- https://lists.fedoraproject.org/archives/list/[email protected]/message/REOZCUAPCA7NFDWYBDYX6EYXWLHABKBO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WSIGDBHAB3I75JBJNGWEPBTJPS2FOVHD
More backstage Containerd vulnerabilities
- TI-2021-19622 Improper Preservation of Permissions in containerd CVSS 3.1CRITICAL 9.1
- TI-2023-10635 containerd supplementary groups are not set up properly CVSS 3.1HIGH 7.8
- TI-2022-07700 Insecure handling of image volumes in containerd CRI plugin CVSS 3.1HIGH 7.5
- TI-2026-38567 Improper input validation in backstage containerd CVSS 4.0CRITICAL 9.4
- TI-2026-38569 containerd CRI checkpoint restore CDI annotation smuggling CVSS 4.0HIGH 8.4
- TI-2025-29820 Containerd vulnerable to host filesystem access during image unpack CVSS 4.0HIGH 7.6
Sources
- CVE-2022-31030 · CVE Program
- CVE-2022-31030 · NVD
- FIRST EPSS
- GHSA-5ffw-gxpp-mxpf · GitHub Advisory Database · CC BY 4.0
- CVE-2022-31030 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences