{
  "cveId": "CVE-2022-23471",
  "url": "https://patchblox.com/security/cve/CVE-2022-23471",
  "summary": "CVE-2022-23471 is fixed in 6 products on 1 platform, first by containerd 1.5.9-0ubuntu1~18.04.2, released December 7, 2022. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "containerd: containerd is an open source container runtime",
  "description": "containerd is an open source container runtime. A bug was found in containerd\u0027s CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user\u0027s process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd\u0027s CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16.  Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers.",
  "published": "2022-12-07T16:00:00Z",
  "severity": "Medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.01109,
  "epssPercentile": 0.66112,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "containerd",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1.6.12~ds1-1",
      "fix": "DEBIAN-CVE-2022-23471",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23471",
      "released": "2022-12-07T23:15:09Z"
    },
    {
      "platform": "linux",
      "product": "containerd",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.6.12~ds1-1",
      "fix": "DEBIAN-CVE-2022-23471",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23471",
      "released": "2022-12-07T23:15:09Z"
    },
    {
      "platform": "linux",
      "product": "containerd",
      "release": "Debian 14",
      "fixedVersion": "1.6.12~ds1-1",
      "fix": "DEBIAN-CVE-2022-23471",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-23471",
      "released": "2022-12-07T23:15:09Z"
    },
    {
      "platform": "linux",
      "product": "containerd",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.5.9-0ubuntu1~18.04.2",
      "fix": "containerd 1.5.9-0ubuntu1~18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-containerd-1.5.9-0ubuntu1-18.04.2",
      "released": "2022-12-07T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.5.9-0ubuntu1~20.04.6",
      "fix": "containerd 1.5.9-0ubuntu1~20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-containerd-1.5.9-0ubuntu1-20.04.6",
      "released": "2022-12-07T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.5.9-0ubuntu3.1",
      "fix": "containerd 1.5.9-0ubuntu3.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-containerd-1.5.9-0ubuntu3.1",
      "released": "2022-12-07T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd",
      "release": "amzn 2023",
      "fixedVersion": "1.6.19-1.amzn2023.0.1",
      "fix": "ALAS2023-2023-156",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-156",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.6.19-1.amzn2023.0.1",
      "fix": "ALAS2023-2023-156",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-156",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "1.6.19-1.amzn2023.0.1",
      "fix": "ALAS2023-2023-156",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-156",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd-stress",
      "release": "amzn 2023",
      "fixedVersion": "1.6.19-1.amzn2023.0.1",
      "fix": "ALAS2023-2023-156",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-156",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "containerd-stress-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "1.6.19-1.amzn2023.0.1",
      "fix": "ALAS2023-2023-156",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-156",
      "released": "2023-03-30T21:11:00Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-containerd-containerd-dev",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.5.9-0ubuntu1~18.04.2",
      "fix": "golang-github-containerd-containerd-dev 1.5.9-0ubuntu1~18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-golang-github-containerd-containerd-dev-1.5.9-0ubuntu1-18.04.2",
      "released": "2022-12-07T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-containerd-containerd-dev",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.5.9-0ubuntu1~20.04.6",
      "fix": "golang-github-containerd-containerd-dev 1.5.9-0ubuntu1~20.04.6",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-golang-github-containerd-containerd-dev-1.5.9-0ubuntu1-20.04.6",
      "released": "2022-12-07T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-containerd-containerd-dev",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.5.9-0ubuntu3.1",
      "fix": "golang-github-containerd-containerd-dev 1.5.9-0ubuntu3.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-golang-github-containerd-containerd-dev-1.5.9-0ubuntu3.1",
      "released": "2022-12-07T16:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}