CVE catalog

CVE-2022-31030

containerd: CVE-2022-31030

[CVE catalog]

Severity
Medium · CVSS 5.7CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.38% · Oct 25, 2026

containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancontainerdsid2.1.9+ds1-5fixed
Debiancontainerdforky2.1.9+ds1-5fixed
Debiancontainerdtrixie1.7.24~ds1-6+deb13u1fixed
Debiancontainerdtrixie-security1.7.24~ds1-6+deb13u1fixed
Debiancontainerdbookworm1.6.20~ds1-1+deb12u3fixed
Debiancontainerdbookworm-security1.6.20~ds1-1+deb12u2fixed
Opensusecontainerdtumbleweed1.6.6-1.1fixed
Ubuntucontainerdpro0.2.1-0ubuntu4~16.04vulnerable
Ubuntucontainerdpro0.2.3-0ubuntu1~16.04vulnerable
Ubuntucontainerdpro0.2.5-0ubuntu1~16.04.1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.2vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.3vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.4vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.5vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm1vulnerable
Ubuntucontainerdpro1.2.6-0ubuntu1~16.04.6+esm2fixed
Ubuntucontainerd18.040.2.5-0ubuntu2vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.2.6-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.3.3-0ubuntu1~18.04.4vulnerable
Ubuntucontainerd18.041.4.4-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.2vulnerable
Ubuntucontainerd18.041.5.2-0ubuntu1~18.04.3vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.1vulnerable
Ubuntucontainerd18.041.5.5-0ubuntu3~18.04.2vulnerable
Ubuntucontainerd18.041.5.9-0ubuntu1~18.04.1vulnerable
Ubuntucontainerd18.041.5.9-0ubuntu1~18.04.2fixed
Ubuntucontainerd20.041.2.10-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.2-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.1vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.2vulnerable
Ubuntucontainerd20.041.3.3-0ubuntu2.3vulnerable
Ubuntucontainerd20.041.4.4-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.2vulnerable
Ubuntucontainerd20.041.5.2-0ubuntu1~20.04.3vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.1vulnerable
Ubuntucontainerd20.041.5.5-0ubuntu3~20.04.2vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.1vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.4vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.5vulnerable
Ubuntucontainerd20.041.5.9-0ubuntu1~20.04.6fixed
Ubuntucontainerd22.041.5.5-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu1vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu2vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3vulnerable
Ubuntucontainerd22.041.5.9-0ubuntu3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancontainerdsourcesid1.6.6~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourceforky1.6.6~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourcetrixie1.6.6~ds1-1not yet assignedNot reportedNot reported
Debiancontainerdsourcebookworm1.6.6~ds1-1not yet assignedNot reportedNot reported
Opensusecontainerdrpmtumbleweed1.6.6-1.1Not reportedOPENSUSE-SU-2024:12130-1Not reported
Ubuntucontainerddebpro1.2.6-0ubuntu1~16.04.6+esm2Not reportedUBUNTU-CVE-2022-31030Not reported
Ubuntucontainerddeb18.041.5.9-0ubuntu1~18.04.2Not reportedUBUNTU-CVE-2022-31030Not reported
Ubuntucontainerddeb20.041.5.9-0ubuntu1~20.04.6Not reportedUBUNTU-CVE-2022-31030Not reported
Ubuntucontainerddeb22.041.5.9-0ubuntu3.1Not reportedUBUNTU-CVE-2022-31030Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [containerd]Unknown
    Details (4)

    • 1.6.20~ds1-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.6.6~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.6.6~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.6~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.6~ds1-1

      dsa · containerd · debian · bookworm

  • [golang-github-containerd-containerd-dev]Unknown

    Source package: [containerd]

    Details (4)

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.6~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.6.6~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.6~ds1-1

      dsa · containerd · debian · bookworm

    • 1.6.20~ds1-1+deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.6.6~ds1-1

      dsa · containerd · debian · bookworm

[openSUSE Tumbleweed]

  • [containerd]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 1.6.6-1.1

      dsa · containerd · opensuse · tumbleweed

  • [containerd-ctr]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 1.6.6-1.1

      Version impact unknown

      dsa · containerd · opensuse · tumbleweed

  • [containerd-devel]Unknown

    Source package: [containerd]

    Details (1)

    • 1.7.33-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.6.6-1.1

      Version impact unknown

      dsa · containerd · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]