7.8

CVE-2022-1708: fedoraproject fedora Uncontrolled Resource Consumption

Modified
AliasesMGASA-2023-0240SUSE-SU-2022:3896-1SUSE-SU-2022:4607-1
Published 07-06-2022Last modified 03-08-2024

Vulnerability summary

CVE-2022-1708 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in fedoraproject fedora. EPSS estimates a 3.16% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v2.0 (NVD)
EPSS score
3.16%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 4
RHSA-2022:4947RHSA-2022:7457RHSA-2022:7469RHSA-2022:7529

Timeline

  1. 07-06-2022
    PublishedVulnerability first disclosed.
  2. 03-08-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

3.16%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.16% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Cri O

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse21 products
  • conmon&distro=SUSE Enterprise Storage 6< 2.1.3-150100.3.9.1
  • conmon&distro=SUSE Enterprise Storage 7< 2.1.3-150100.3.9.1
  • conmon&distro=SUSE Enterprise Storage 7.1< 2.1.5-150300.8.6.1
  • conmon&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.1.3-150100.3.9.1
  • conmon&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.1.3-150100.3.9.1
Redhat8 products
  • enterprise_linuxEOL7.0 | 8.0 | 9.0
  • openshift_container_platform3.11 | 4.0 | 4.9 | 4.10
  • conmon< 2:2.0.29-3.rhaos4.10.el8 | < 2:2.0.29-3.rhaos4.8.el7 | < 2:2.0.29-3.rhaos4.8.el8 | < 2:2.0.29-3.rhaos4.7.el7 | < 2:2.0.29-3.rhaos4.7.el8 | < 2:2.0.29-3.rhaos4.9.el7 | < 2:2.0.29-3.rhaos4.9.el8
  • conmon-debuginfo< 2:2.0.29-3.rhaos4.10.el8 | < 2:2.0.29-3.rhaos4.7.el7 | < 2:2.0.29-3.rhaos4.7.el8 | < 2:2.0.29-3.rhaos4.9.el7 | < 2:2.0.29-3.rhaos4.9.el8
  • conmon-debugsource< 2:2.0.29-3.rhaos4.10.el8 | < 2:2.0.29-3.rhaos4.7.el8 | < 2:2.0.29-3.rhaos4.9.el8
Opensuse6 products
  • conmon&distro=openSUSE Leap 15.3< 2.1.5-150300.8.6.1
  • conmon&distro=openSUSE Leap 15.4< 2.1.5-150400.3.3.1
  • conmon&distro=openSUSE Leap Micro 5.2< 2.1.5-150300.8.6.1
  • conmon&distro=openSUSE Leap Micro 5.3< 2.1.5-150400.3.3.1
  • conmon&distro=openSUSE Tumbleweed< 2.1.2-1.1
Alpine1 product
  • cri-o≥ 1.20.0, < 1.24.1-r0
Fedoraproject1 product
Github.com/cri-o1 product
  • cri-o≥ 1.23.0, < 1.23.3 | < 1.22.5 | ≥ 1.24.0, < 1.24.1
Kubernetes1 product
  • cri-o< 1.19.7 | ≥ 1.20.0, < 1.20.8 | ≥ 1.21.0, < 1.21.8 | ≥ 1.22.0, < 1.22.5 | ≥ 1.23.0, < 1.23.3 | 1.24.0
Mageia1 product
  • cri-o< 1.25.1-1.mga8

8 vendors · 40 products

References

29 links
Show all 29 references