Resource exhaustion in containerd - CVE-2022-31030

Vulnerability identifier: #VU64007

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31030

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the ExecSync API. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

containerd
DB2 Data Management Console
DB2 Data Management Console on CPD
PowerStore X
PowerStore T
IBM Cloud Pak for Watson AIOps
DB2 on Cloud Pak for Data
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Containers
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
openSUSE Leap
Ubuntu
openEuler
Fedora
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Robotic Process Automation
IBM MQ Operator
IBM Cloud Pak for Data Scheduling
IBM Decision Optimization for Cloud Pak for Data
Data Replication on Cloud Pak for Data
containerd (Debian package)
SUSE Linux Enterprise Module for Packagehub Subpackages
golang-x-sys
golang-github-containernetworking-cni
runc
runc-debuginfo
golang-github-containerd-cni
containerd
containerd (Ubuntu package)
containerd-ctr
app-containers/containerd
docker
docker-debuginfo
docker-kubic-zsh-completion
docker-kubic-fish-completion
docker-kubic-bash-completion
docker-fish-completion
docker-bash-completion
docker-kubic-kubeadm-criconfig
docker-kubic-debuginfo
docker-kubic
docker-zsh-completion
QRadar Suite
IBM Edge Application Manager
Cloud Pak for Data
Dell EMC VxRail Appliance

Install updates from vendor's website.

containerd - addressed in versions 1.5.13, 1.6.6
containerd (Debian package) - update to 1.4.13~ds1-1~deb11u2
QRadar Suite - update to 1.10.19.0
IBM Cloud Transformation Advisor - update to 3.10.2
DB2 Data Management Console - update to 3.1.13.1
DB2 Data Management Console on CPD - update to 4.7.2
IBM Robotic Process Automation - update to 21.0.3.1
golang-x-sys - addressed in versions 0-23.20220604gitbc2c85a.fc35, 0-23.20220604gitbc2c85a.fc36
golang-github-containernetworking-cni - addressed in versions 1.1.1-1.fc35, 1.1.1-1.fc36
runc - addressed in versions 1.1.3-16.21.1, 1.1.3-150000.30.1
runc-debuginfo - addressed in versions 1.1.3-16.21.1, 1.1.3-150000.30.1
golang-github-containerd-cni - addressed in versions 1.1.6-1.fc35, 1.1.6-1.fc36
containerd - update to 1.2.0-203
containerd (Ubuntu package) - addressed in versions 1.5.9-0ubuntu1~18.04.2, 1.5.9-0ubuntu1~20.04.6, 1.5.9-0ubuntu3.1, 1.6.4-0ubuntu1.1
containerd - addressed in versions 1.6.6-1.fc35, 1.6.6-1.fc36
containerd - addressed in versions 1.6.6-16.62.1, 1.6.6-150000.73.2
containerd-ctr - update to 1.6.6-150000.73.2
containerd - update to 1.6.8-2
app-containers/containerd - update to 1.6.14
IBM MQ Operator - addressed in versions 2.0.17, 3.0.0
PowerStore X - update to 3.2.1.0-1989710
PowerStore T - update to 3.2.1.0-1989710
IBM Cloud Pak for Watson AIOps - update to 4.7.0
IBM Cloud Pak for Data Scheduling - update to 4.8.0
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
Data Replication on Cloud Pak for Data - update to 4.8.0
DB2 on Cloud Pak for Data - update to 4.8.4
Cloud Pak for Data - update to 4.8.5
Dell EMC VxRail Appliance - update to 8.0.000
docker - addressed in versions 20.10.17_ce-98.83.1, 20.10.17_ce-150000.166.1
docker-debuginfo - addressed in versions 20.10.17_ce-98.83.1, 20.10.17_ce-150000.166.1
docker-kubic-zsh-completion - update to 20.10.17_ce-150000.166.1
docker-kubic-fish-completion - update to 20.10.17_ce-150000.166.1
docker-kubic-bash-completion - update to 20.10.17_ce-150000.166.1
docker-fish-completion - update to 20.10.17_ce-150000.166.1
docker-bash-completion - update to 20.10.17_ce-150000.166.1
docker-kubic-kubeadm-criconfig - update to 20.10.17_ce-150000.166.1
docker-kubic-debuginfo - update to 20.10.17_ce-150000.166.1
docker-kubic - update to 20.10.17_ce-150000.166.1
docker-zsh-completion - update to 20.10.17_ce-150000.166.1

• https://github.com/containerd/containerd/releases/tag/v1.5.13
• https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf

• Denial of service in containerd
• Amazon Linux AMI update for containerd
• Debian update for containerd
• SUSE update for containerd
• SUSE update for containerd, docker and runc
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Ubuntu update for containerd
• Multiple vulnerabilities in Dell VxRail Appliance components
• Resource exhaustion in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Gentoo update for containerd
• Multiple vulnerabilities in IBM Cloud Pak for Data Scheduling
• Multiple vulnerabilities in IBM QRadar Suite Software
• openEuler update for containerd
• Resource exhaustion in Data Replication on Cloud Pak for Data
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data
• Amazon Linux AMI update for containerd
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Fedora 36 update for containerd, golang-github-containerd-cni, golang-github-containernetworking-cni, golang-x-sys
• Fedora 35 update for containerd, golang-github-containerd-cni, golang-github-containernetworking-cni, golang-x-sys
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM DB2 Data Management Console