CVE-2022-31030: containerd CRI plugin: Host memory exhaustion through ExecSync
Summary
CVE-2022-31030: containerd CRI plugin: Host memory exhaustion through ExecSync. Affects github.com/containerd/containerd across 2 version ranges.
< 1.5.13
>= 1.6.0, < 1.6.6
Fixed in 1.5.13 or 1.6.6, depending on the release line you run. How to fix ↓
Also tracked for
- containerd · Debian:11
The same CVE-2022-31030 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Containerd is an open-source container runtime that provides a reliable and scalable foundation for container deployments. It is widely used in container orchestration systems like Kubernetes. The CRI (Container Runtime Interface) plugin in containerd allows Kubernetes and other container runtimes to interact with containerd. The ExecSync API in the CRI implementation of containerd is responsible for executing processes inside containers. However, a vulnerability has been discovered in this implementation that can lead to host memory exhaustion.
Vulnerability Detail
The vulnerability in containerd's CRI implementation allows programs running inside a container to trigger a memory consumption issue in the containerd daemon. By invoking the ExecSync API with specific parameters, an attacker can cause the containerd daemon to consume memory without bounds. This can result in the exhaustion of all available memory on the host system, leading to a denial of service for other legitimate workloads. The vulnerability affects containerd versions prior to 1.5.13 and 1.6.6.
How To Fix
Latest published version: v1.7.36 as of 22 Oct 2026
go get github.com/containerd/containerd@v1.7.36Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.5.131.5.13go get github.com/containerd/containerd@v1.5.13 -
>= 1.6.0, < 1.6.61.6.6go get github.com/containerd/containerd@v1.6.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can ensure that only trusted images and commands are used within containers. By carefully vetting the images and commands executed within containers, the risk of triggering the memory exhaustion vulnerability can be reduced. However, this is not a foolproof solution and updating to the patched versions of containerd is still strongly advised.
Conclusion
The vulnerability in containerd's CRI implementation can lead to host memory exhaustion, causing a denial of service for other workloads. It is crucial to update containerd to the patched versions (1.5.13 or 1.6.6) to mitigate the risk. Additionally, exercising caution by using trusted images and commands within containers can help reduce the likelihood of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/containerd/containerd →
FAQ
Containerd is an open-source container runtime that provides a reliable and scalable foundation for container deployments. It is widely used in container orchestration systems like Kubernetes.
The CRI (Container Runtime Interface) plugin in containerd allows Kubernetes and other container runtimes to interact with containerd. It provides the necessary APIs and functionality for managing containers and executing processes within them.
The vulnerability allows programs running inside a container to trigger a memory consumption issue in the containerd daemon. By invoking the ExecSync API with specific parameters, an attacker can cause the containerd daemon to consume memory without bounds, leading to host memory exhaustion.
The vulnerability can result in the exhaustion of all available memory on the host system, denying service to other legitimate workloads. This can lead to a significant impact on the overall performance and availability of the system.
To mitigate the risk of exploitation, it is recommended to update containerd to version 1.5.13 or 1.6.6. These versions include the necessary patches to address the memory exhaustion issue. Additionally, users should ensure that only trusted images and commands are used within containers.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containerd/containerd.
