Resource exhaustion in containerd - CVE-2025-64329

Vulnerability identifier: #VU118176

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-64329

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists in CRI Attach implementation due to goroutine leaks. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack against the host.

containerd
Debian Linux
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Containers Module
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Engineering Lifecycle Management
IBM Observability with Instana
containerd
containerd (Ubuntu package)
containerd (Debian package)
containerd-doc
containerd-devel
containerd-ctr

Install updates from vendor's website.

containerd - addressed in versions 1.7.29, 2.0.7, 2.1.5, 2.2.0
Engineering Lifecycle Management - update to 1.3.0
IBM Observability with Instana - update to 1.0.313
containerd - addressed in versions 1.2.0-222, 1.2.0-324, 1.6.22-25
containerd (Ubuntu package) - addressed in versions 1.2.6-0ubuntu1~16.04.6+esm6, 1.6.12-0ubuntu1~18.04.1+esm3, 1.6.12-0ubuntu1~20.04.8+esm1, 1.6.12-0ubuntu1~22.04.10, 1.6.24~ds1-1ubuntu1.3+esm2, 1.7.24~ds1-8ubuntu1.1, 1.7.24-0ubuntu1~20.04.2+esm1, 1.7.28-0ubuntu1~22.04.1+esm1, 1.7.28-0ubuntu1~24.04.2, 2.1.3-0ubuntu3.1
containerd (Debian package) - addressed in versions 1.6.20~ds1-1+deb12u2, 1.7.24~ds1-6+deb13u1
containerd-doc - update to 1.7.29-1
containerd - update to 1.7.29-1
containerd - addressed in versions 1.7.29-16.105.1, 1.7.29-150000.128.1
containerd-devel - addressed in versions 1.7.29-16.105.1, 1.7.29-150000.128.1
containerd-ctr - addressed in versions 1.7.29-16.105.1, 1.7.29-150000.128.1

• https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2

• Multiple vulnerabilities in containerd
• SUSE update for containerd
• openEuler 22.03 LTS SP3 update for containerd
• openEuler 24.03 LTS SP2 update for containerd
• openEuler 24.03 LTS SP1 update for containerd
• openEuler 24.03 LTS update for containerd
• openEuler 22.03 LTS SP4 update for containerd
• SUSE update for containerd
• Debian update for containerd
• Anolis OS update for containerd
• openEuler 20.03 LTS SP4 update for containerd
• Ubuntu update for containerd
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Engineering Lifecycle Management on Hybrid Cloud