CVE-2022-31030: containerd CRI plugin: Host memory exhaustion through ExecSync
Vulnerability summary
CVE-2022-31030 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in containerd. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 32.8% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 06-06-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.
CVSS metrics
9 scores · 8 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · GoEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.38% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- containerd< 1.6.6~ds1-1
- debian_linuxEOL11.0
Alpine1 product
- containerd≥ 1.6.0, < 1.6.6-r0
Chainguard1 product
- ctop< 0.7.7-r13
Containerd1 product
- containerd< 1.5.13 | ≥ 1.6.0, < 1.6.6
Fedoraproject1 product
- fedoraEOL35 | 36
Github.com/containerd1 product
- containerd< 1.5.13 | ≥ 1.6.0, < 1.6.6
Linuxfoundation1 product
- containerd< 1.5.13 | ≥ 1.6.0, < 1.6.6
Mageia1 product
- docker-containerd< 1.5.13-1.mga8
Opensuse1 product
- containerd&distro=openSUSE Tumbleweed< 1.6.6-1.1
Ubuntu1 product
- containerd< 1.2.6-0ubuntu1~16.04.6+esm2 | < 1.5.9-0ubuntu1~18.04.2 | < 1.5.9-0ubuntu1~20.04.6 | < 1.5.9-0ubuntu3.1
Wolfi1 product
- ctop< 0.7.7-r13
11 vendors · 12 products
References
23 links- github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpfAdvisoryREPORTWEBThird Party Advisory
- github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382REPORTFIXWEBProductThird Party Advisory
