Missing Release of Resource after Effective Lifetime in containerd - #VU155697

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to missing release of read-only mounts and pinned snapshots in containerd's CRI plugin when restoring a container from a checkpoint image fails. A local user can repeatedly create containers from checkpoint images with malformed metadata or a base image that cannot be pulled to cause a denial of service.

The issue occurs on Linux with CRI checkpoint and restore support enabled. In Kubernetes, exhaustion of the host mount table and disk space can prevent containerd and the kubelet from pulling images or starting new pods on the node.

Affected software

Remediation

External References

• https://github.com/containerd/containerd/security/advisories/GHSA-5p7c-hggf-c748

Related Security Bulletins

• Multiple vulnerabilities in containerd