=====================================================================

                                CERT-Renater

                    Note d'Information No. 2022/VULN452

_____________________________________________________________________

DATE                : 08/12/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running containerd versions prior to
                                      1.5.16, 1.6.12.

=====================================================================
https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j-52j9
_____________________________________________________________________


containerd CRI stream server: Host memory exhaustion through Terminal
resize goroutine leak
Moderate    samuelkarp published GHSA-2qjp-425j-52j9

Package
No package listed

Affected versions
< 1.5.16, 1.6.0-1.6.11

Patched versions
1.5.16, 1.6.12


Description

Impact
A bug was found in containerd's CRI implementation where a user can
exhaust memory on the host. In the CRI stream server, a goroutine
is launched to handle terminal resize events if a TTY is requested.
If the user's process fails to launch due to, for example, a
faulty command, the goroutine will be stuck waiting to send without
a receiver, resulting in a memory leak. Kubernetes and crictl can
both be configured to use containerd's CRI implementation and the
stream server is used for handling container IO.


Patches
This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should
update to these versions to resolve the issue.


Workarounds
Ensure that only trusted images and commands are used and that only
trusted users have permissions to execute commands in running
containers.


For more information
If you have any questions or comments about this advisory:

Open an issue in containerd
Email us at security@containerd.io
To report a security issue in containerd:


Report a new vulnerability
Email us at security@containerd.io


Severity
Moderate

CVE ID
CVE-2022-23471

Weaknesses
No CWEs


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================