Skip to content
Fencer Vulns
medium 5.5

CVE-2022-31030 json

containerd CRI plugin: Host memory exhaustion through ExecSync

published 2022-06-06 4 y ago modified 2026-09-10 1 mo ago also GHSA-5ffw-gxpp-mxpf , GO-2022-0482 , EUVD-2022-5937

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.

Patch / fix

  • go github.com/containerd/containerd 1.5.13, 1.6.6
  • linuxfoundation containerd 1.5.13, 1.6.6
  • containerd Debian 14, Debian 13, Debian 12 1.6.6~ds1-1

debian advisories DEBIAN-CVE-2022-31030

  • containerd Ubuntu 18.04 LTS 1.5.9-0ubuntu1~18.04.2
  • containerd Ubuntu 20.04 LTS 1.5.9-0ubuntu1~20.04.6
  • containerd Ubuntu 22.04 LTS 1.5.9-0ubuntu3.1
  • containerd Ubuntu Pro 16.04 LTS 1.2.6-0ubuntu1~16.04.6+esm2

ubuntu advisories UBUNTU-CVE-2022-31030

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • runc SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +23 more 1.1.3-150000.30.1
  • docker SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +22 more 20.10.17_ce-150000.166.1
  • containerd SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +23 more 1.6.6-150000.73.2
  • docker-kubic openSUSE Leap 15.4, openSUSE Leap 15.3 20.10.17_ce-150000.166.1
  • containerd SLE Module for Containers 12 1.6.6-16.62.1
  • runc SLE Module for Containers 12 1.1.3-16.21.1
  • docker SLE Module for Containers 12 20.10.17_ce-98.83.1

suse advisories SUSE-SU-2022:2341-1SUSE-SU-2022:2165-1

  • containerd openSUSE Tumbleweed 1.6.6-1.1

opensuse advisories openSUSE-SU-2024:12130-1

  • containerd Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 1.6.6-r0

alpine advisories ALPINE-CVE-2022-31030

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • moby-containerd CBL-Mariner 2.0 1.6.6-1

azure linux advisories AZL-9918

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • containerd Arch Linux 1.6.6-1

arch linux advisories AVG-2755

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-31030 updated cvss 5.7

containerd: uncontrolled resource consumption may lead to DoS

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/containerd/containerd
<1.5.13
>=1.6.0, <1.6.6
1.5.13
1.6.6

Affected products

  • containerd containerd

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.