containerd: containerd is an open source container runtime
CVE-2022-23471 is fixed in 6 products on 1 platform, first by containerd 1.5.9-0ubuntu1~18.04.2, released December 7, 2022. It is not reported as exploited. Patch Radar priority: Routine.
containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| containerd · Debian 12.15 (bookworm) | 1.6.12~ds1-1 | DEBIAN-CVE-2022-23471 | Dec 7, 2022 |
| containerd · Debian 13.5 (trixie) | 1.6.12~ds1-1 | DEBIAN-CVE-2022-23471 | Dec 7, 2022 |
| containerd · Debian 14 | 1.6.12~ds1-1 | DEBIAN-CVE-2022-23471 | Dec 7, 2022 |
| containerd · Ubuntu 18.04.6 LTS (bionic) | 1.5.9-0ubuntu1~18.04.2 | containerd 1.5.9-0ubuntu1~18.04.2 | Dec 7, 2022 |
| containerd · Ubuntu 20.04 LTS (focal) | 1.5.9-0ubuntu1~20.04.6 | containerd 1.5.9-0ubuntu1~20.04.6 | Dec 7, 2022 |
| containerd · Ubuntu 22.04.1 LTS (jammy) | 1.5.9-0ubuntu3.1 | containerd 1.5.9-0ubuntu3.1 | Dec 7, 2022 |
| containerd · amzn 2023 | 1.6.19-1.amzn2023.0.1 | ALAS2023-2023-156 | Mar 30, 2023 |
| containerd-debuginfo · amzn 2023 | 1.6.19-1.amzn2023.0.1 | ALAS2023-2023-156 | Mar 30, 2023 |
| containerd-debugsource · amzn 2023 | 1.6.19-1.amzn2023.0.1 | ALAS2023-2023-156 | Mar 30, 2023 |
| containerd-stress · amzn 2023 | 1.6.19-1.amzn2023.0.1 | ALAS2023-2023-156 | Mar 30, 2023 |
| containerd-stress-debuginfo · amzn 2023 | 1.6.19-1.amzn2023.0.1 | ALAS2023-2023-156 | Mar 30, 2023 |
| golang-github-containerd-containerd-dev · Ubuntu 18.04.6 LTS (bionic) | 1.5.9-0ubuntu1~18.04.2 | golang-github-containerd-containerd-dev 1.5.9-0ubuntu1~18.04.2 | Dec 7, 2022 |
| golang-github-containerd-containerd-dev · Ubuntu 20.04 LTS (focal) | 1.5.9-0ubuntu1~20.04.6 | golang-github-containerd-containerd-dev 1.5.9-0ubuntu1~20.04.6 | Dec 7, 2022 |
| golang-github-containerd-containerd-dev · Ubuntu 22.04.1 LTS (jammy) | 1.5.9-0ubuntu3.1 | golang-github-containerd-containerd-dev 1.5.9-0ubuntu3.1 | Dec 7, 2022 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.