6.5

CVE-2022-23471: containerd CRI stream server: Host memory exhaustion through terminal resize goroutine leak

Modified
AliasesSUSE-SU-2023:1566-1SUSE-SU-2023:1628-1UBUNTU-CVE-2022-23471
Published 07-12-2022Last modified 23-04-2025

Vulnerability summary

CVE-2022-23471 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in containerd. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.9% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.7, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
1.11%
0%100%
Low · +0.04 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 6
MGASA-2023-0245SUSE-SU-2022:4409-1SUSE-SU-2022:4463-1USN-5776-1CGA-342F-5G83-VF7FCGA-57RR-RPPF-CC3F

Timeline

  1. 07-12-2022
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

1.11%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

Increase +0.04 pp

From 1.07% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Suse17 products
  • containerd&distro=SUSE Enterprise Storage 7< 1.6.16-150000.82.2
  • containerd&distro=SUSE Enterprise Storage 7.1< 1.6.16-150000.82.2
  • containerd&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.6.16-150000.82.2
  • containerd&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.6.16-150000.82.2
  • containerd&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.6.16-150000.82.2
Opensuse3 products
  • containerd&distro=openSUSE Leap 15.4< 1.6.16-150000.82.2
  • containerd&distro=openSUSE Leap Micro 5.3< 1.6.16-150000.82.2
  • containerd&distro=openSUSE Tumbleweed< 1.6.12-1.1
Alpine1 product
  • containerd≥ 1.6.0, < 1.6.12-r0
Chainguard1 product
  • ctop< 0.7.7-r13
Containerd1 product
Debian1 product
  • containerd< 1.6.12~ds1-1
Github.com/containerd1 product
  • containerd< 1.5.16 | ≥ 1.6.0, < 1.6.12
Linuxfoundation1 product
Ubuntu1 product
  • containerdAll versions (No fix recorded) | < 1.5.9-0ubuntu1~18.04.2 | < 1.5.9-0ubuntu1~20.04.6 | < 1.5.9-0ubuntu3.1
Wolfi1 product
  • ctop< 0.7.7-r13

10 vendors · 28 products

References

18 links
Show all 18 references