Description
containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the `ExecSync` API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; `ExecSync` may be used when running probes or when executing processes via an "exec" facility. This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| containerd | containerd | < 1.5.13, >= 1.6.0, < 1.6.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | containerd | 1.6.6~ds1-1 | — |
| Debian 13 | containerd | 1.6.6~ds1-1 | — |
| Debian 12 | containerd | 1.6.6~ds1-1 | — |
| Debian 11 | containerd | 1.4.13~ds1-1~deb11u2 | DSA-5162-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | containerd | 1.5.9-0ubuntu3.1 | USN-5776-1 |
| Ubuntu 20.04 LTS | containerd | 1.5.9-0ubuntu1~20.04.6 | USN-5776-1 |
| Ubuntu 18.04 LTS | containerd | 1.5.9-0ubuntu1~18.04.2 | USN-5776-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | containerd | 1.2.6-0ubuntu1~16.04.6+esm2 | USN-5521-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLES 15 SP4 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLES 15 SP4 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLES 15 SP3 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLES 15 SP3 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLES 15 SP3 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLES 15 SP2 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLES 15 SP2 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLES 15 SP2 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLES 15 SP1 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLES 15 SP1 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLES 15 SP1 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLES 15 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLES 15 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLES 15 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | containerd | 1.6.6-16.62.1 | SUSE-SU-2022:2165-1 |
| SLES 12 | docker | 20.10.17_ce-98.83.1 | SUSE-SU-2022:2165-1 |
| SLES 12 | runc | 1.1.3-16.21.1 | SUSE-SU-2022:2165-1 |
| SLES for SAP 15 SP2 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLES for SAP 15 SP2 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLES for SAP 15 SP2 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLES for SAP 15 SP1 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLES for SAP 15 SP1 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLES for SAP 15 SP1 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLES for SAP 15 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLES for SAP 15 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLES for SAP 15 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLE Micro 5.2 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLE Micro 5.2 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLE Micro 5.2 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLE Micro 5.1 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLE Micro 5.1 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLE Micro 5.1 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 SP2 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 SP2 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 SP2 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 SP1 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 SP1 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 SP1 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SLE HPC 15 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SUSE Manager Server 4.1 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SUSE Manager Server 4.1 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SUSE Manager Server 4.1 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SUSE Manager Retail Branch Server 4.1 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SUSE Manager Retail Branch Server 4.1 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SUSE Manager Retail Branch Server 4.1 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SUSE Manager Proxy 4.1 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SUSE Manager Proxy 4.1 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SUSE Manager Proxy 4.1 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SUSE Enterprise Storage 7.1 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SUSE Enterprise Storage 7 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SUSE Enterprise Storage 7 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SUSE Enterprise Storage 7 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| SUSE Enterprise Storage 6 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| SUSE Enterprise Storage 6 | docker | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| SUSE Enterprise Storage 6 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | containerd | 1.6.6-1.1 | openSUSE-SU-2024:12130-1 |
| openSUSE Leap 15.4 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| openSUSE Leap 15.4 | docker +1 | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| openSUSE Leap 15.4 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
| openSUSE Leap 15.3 | containerd | 1.6.6-150000.73.2 | SUSE-SU-2022:2341-1 |
| openSUSE Leap 15.3 | docker +1 | 20.10.17_ce-150000.166.1 | SUSE-SU-2022:2341-1 |
| openSUSE Leap 15.3 | runc | 1.1.3-150000.30.1 | SUSE-SU-2022:2341-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | containerd | 1.6.6-r0 | — |
| Alpine v3.23 | containerd | 1.6.6-r0 | — |
| Alpine v3.22 | containerd | 1.6.6-r0 | — |
| Alpine v3.21 | containerd | 1.6.6-r0 | — |
| Alpine v3.20 | containerd | 1.6.6-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | containerd | 1.6.6-r0 | — |
| Alpine v3.18 | containerd | 1.6.6-r0 | — |
| Alpine v3.17 | containerd | 1.6.6-r0 | — |
| Alpine v3.16 | containerd | 1.6.6-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | containerd +1 | 1.6.8-2.amzn2023.0.3 | ALAS2023-2023-079 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | moby-containerd | 1.6.6-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ctop | 0.7.7-r13 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/containerd/containerd | < 1.5.13 | 1.5.13 | GHSA-5ffw-gxpp-mxpf |
| Go | github.com/containerd/containerd | >= 1.6.0, < 1.6.6 | 1.6.6 | GHSA-5ffw-gxpp-mxpf |
| Go | github.com/containerd/containerd | < 1.5.13 · >= 1.6.0, < 1.6.6 | 1.5.13, 1.6.6 | GO-2022-0482 |
Advisories 9
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-5521-1 containerd vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5776-1 containerd vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5162-1 containerd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:2341-1 Security update for containerd, docker and runc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2165-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12130-1 containerd-1.6.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-3146 IBM MQ Operator and Queue manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 13, 2023
- ALAS2023-2023-079 Moderate: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
References
- https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf
- https://github.com/containerd/containerd/commit/c1bcabb4541930f643aa36a2b38655e131346382
- [oss-security] 20220606 CVE-2022-31030: containerd CRI plugin: Host memory exhaustion through ExecSync mailing-list
- DSA-5162 vendor-advisory
- FEDORA-2022-725ac93b48 vendor-advisory
- FEDORA-2022-1da581ac6d vendor-advisory
- GLSA-202401-31 vendor-advisory