CVE-2022-1708

Description

An ExecSync request runs a command in a container and returns the output to the Kubelet. It is used for readiness and liveness probes within a pod. The way CRI-O runs ExecSync commands is through conmon. CRI-O asks conmon to start the process, and conmon writes the output to disk. CRI-O then reads the output and returns it to the Kubelet.

If the output of the command is large enough, it is possible to exhaust the memory (or disk usage) of the node. The following deployment is an example yaml file that will output around 8GB of ‘A’ characters, which would be written to disk by conmon and read by CRI-O.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment100
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh", "-c", "seq 1 50000000`; do echo -n 'aaaaaaaaaaaaaaaa'; done"]

Impact

It is possible for the node to be exhausted of memory or disk space, depending on the node the command is being run on. What is further problematic is that the memory and disk usage aren't attributed to the container, as this file and its processing are implementation details of CRI-O. The consequence of the exhaustion is that other services on the node, e.g. other containers, will be unable to allocate memory and thus causing a denial of service.

Patches

This vulnerability will be fixed in 1.24.1, 1.23.3, 1.22.5, v1.21.8, v1.20.8, v1.19.7

Workarounds

At the time of writing, no workaround exists other than ensuring only trusted images are used.

References

https://github.com/containerd/containerd/security/advisories/GHSA-5ffw-gxpp-mxpf

For more information

If you have any questions or comments about this advisory:

• Open an issue in the CRI-O repo
• To make a report, email your vulnerability to the private [email protected] list with the security details and the details expected for all CRI-O bug reports.

Credits

Disclosed by Ada Logics in a security audit sponsored by CNCF and facilitated by OSTIF.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

• opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

• buildah: possible information disclosure and modification (CVE-2022-2990)

• runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

• runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
• runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

Node DOS by way of memory exhaustion through ExecSync request in CRI-O in github.com/cri-o/cri-o

Denial of service due to memory or disk exhaustion. (CVE-2022-1708)

These are all security issues fixed in the conmon-2.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cri-o-1.24.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for conmon fixes the following issues:

conmon was updated to 2.1.3:

• Stop using g_unix_signal_add() to avoid threads
• Rename CLI optionlog-size-global-max to log-global-size-max

Update to version 2.1.2:

• add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 bsc#1200285)
• journald: print tag and name if both are specified
• drop some logs to debug level

Update to version 2.1.0

• logging: buffer partial messages to journald
• exit: close all fds >= 3
• fix: cgroup: Free memory_cgroup_file_path if open fails. Call g_free instead of free.

Update to version 2.0.32

• Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
• exit_command: Fix: unset subreaper attribute before running exit command

Update to version 2.0.31

• logging: new mode -l passthrough
• ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
• conmon: Fix: free userdata files before exec cleanup

Update to version 2.0.30:

• Remove unreachable code path
• exit: report if the exit command was killed
• exit: fix race zombie reaper
• conn_sock: allow watchdog messages through the notify socket proxy
• seccomp: add support for seccomp notify

Update to version 2.0.29:

• Reset OOM score back to 0 for container runtime
• call functions registered with atexit on SIGTERM
• conn_sock: fix potential segfault

Update to version 2.0.27:

• Add CRI-O integration test GitHub action
• exec: don't fail on EBADFD
• close_fds: fix close of external fds
• Add arm64 static build binary

Update to version 2.0.26:

• conn_sock: do not fail on EAGAIN
• fix segfault from a double freed pointer
• Fix a bug where conmon could never spawn a container, because a disagreement between the caller and itself on where the attach socket was.
• improve --full-attach to ignore the socket-dir directly. that means callers don't need to specify a socket dir at all (and can remove it)
• add full-attach option to allow callers to not truncate a very long path for the attach socket
• close only opened FDs
• set locale to inherit environment

Update to version 2.0.22:

• added man page
• attach: always chdir
• conn_sock: Explicitly free a heap-allocated string
• refactor I/O and add SD_NOTIFY proxy support

Update to version 2.0.21:

• protect against kill(-1)
• Makefile: enable debuginfo generation
• Remove go.sum file and add go.mod
• Fail if conmon config could not be written
• nix: remove double definition for e2fsprogs
• Speedup static build by utilizing CI cache on /nix folder
• Fix nix build for failing e2fsprogs tests
• test: fix CI
• Use Podman for building

This update for conmon fixes the following issues:

conmon was updated to version 2.1.5:

• don't leak syslog_identifier
• logging: do not read more that the buf size
• logging: fix error handling
• Makefile: Fix install for FreeBSD
• signal: Track changes to get_signal_descriptor in the FreeBSD version
• Packit: initial enablement

Update to version 2.1.4:

• Fix a bug where conmon crashed when it got a SIGCHLD

update to 2.1.3:

• Stop using g_unix_signal_add() to avoid threads
• Rename CLI optionlog-size-global-max to log-global-size-max

Update to version 2.1.2:

• add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 bsc#1200285)
• journald: print tag and name if both are specified
• drop some logs to debug level

Update to version 2.1.0

• logging: buffer partial messages to journald
• exit: close all fds >= 3
• fix: cgroup: Free memory_cgroup_file_path if open fails.

Update to version 2.0.32

• Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
• exit_command: Fix: unset subreaper attribute before running exit command

Update to version 2.0.31

• logging: new mode -l passthrough
• ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
• conmon: Fix: free userdata files before exec cleanup

This update for conmon fixes the following issues:

conmon was updated to version 2.1.5:

• don't leak syslog_identifier
• logging: do not read more that the buf size
• logging: fix error handling
• Makefile: Fix install for FreeBSD
• signal: Track changes to get_signal_descriptor in the FreeBSD version
• Packit: initial enablement

Update to version 2.1.4:

• Fix a bug where conmon crashed when it got a SIGCHLD

update to 2.1.3:

• Stop using g_unix_signal_add() to avoid threads
• Rename CLI optionlog-size-global-max to log-global-size-max

Update to version 2.1.2:

• add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 bsc#1200285)
• journald: print tag and name if both are specified
• drop some logs to debug level

Update to version 2.1.0

• logging: buffer partial messages to journald
• exit: close all fds >= 3
• fix: cgroup: Free memory_cgroup_file_path if open fails.

Update to version 2.0.32

• Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
• exit_command: Fix: unset subreaper attribute before running exit command

Update to version 2.0.31

• logging: new mode -l passthrough
• ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
• conmon: Fix: free userdata files before exec cleanup