UpHeron
All vulnerabilities

Servers and applications

CVE-2022-23471

containerd CRI stream server: Host memory exhaustion through Terminal resize goroutine leak

Severity
Medium 6.5
Published
7 Dec 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.5.16, 1.6.12
Also known as
GHSA-2qjp-425j-52j9
Sources
NVD, Project advisories (GitHub)

Description

containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver,…

Affected software

SoftwareAffected versions
containerdServers and applications · cpe:a:linuxfoundation:containerd
  • Every version before 1.5.16
  • From 1.6.0 before 1.6.12
containerdServers and applications · github:containerd/containerd
  • From 1.6.0 before 1.5.16

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-23471
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-23471
  • GitHub Advisory Database https://github.com/advisories/GHSA-2qjp-425j-52j9
  • github.com https://github.com/containerd/containerd/security/advisories/GHSA-2qjp-425j-52j9