CVE-2025-64329
📋 TL;DR
This CVE describes a memory exhaustion vulnerability in containerd's CRI Attach implementation where goroutine leaks allow users to consume host memory. Affected users are those running vulnerable versions of containerd in containerized environments, potentially leading to denial of service. The vulnerability requires access to pod attach resources.
💻 Affected Systems
- containerd
📦 What is this software?
Containerd by Linuxfoundation
Containerd by Linuxfoundation
Containerd by Linuxfoundation
Containerd by Linuxfoundation
Containerd by Linuxfoundation
Containerd by Linuxfoundation
Containerd by Linuxfoundation
Containerd by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete host memory exhaustion leading to system crash, container unavailability, and potential data loss from improper shutdown.
Likely Case
Degraded performance due to memory pressure, container failures, and potential denial of service for affected workloads.
If Mitigated
Minimal impact with proper access controls and monitoring; memory exhaustion limited to authorized users only.
🎯 Exploit Status
Exploitation requires permissions to access pods/attach resources; no authentication bypass needed beyond existing privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.29, 2.0.7, 2.1.5, 2.2.0
Vendor Advisory: https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2
Restart Required: Yes
Instructions:
1. Identify containerd version using 'containerd --version'. 2. Upgrade to patched version via package manager (apt/yum) or direct binary replacement. 3. Restart containerd service: 'systemctl restart containerd'. 4. Verify upgrade with version check.
🔧 Temporary Workarounds
Admission Controller Restriction
linuxImplement Kubernetes admission controller to restrict access to pods/attach resources, limiting exploit surface.
kubectl apply -f admission-controller.yaml
🧯 If You Can't Patch
- Implement strict RBAC policies to limit pod attach permissions to essential users only.
- Monitor memory usage and set alerts for abnormal goroutine counts or memory consumption patterns.
🔍 How to Verify
Check if Vulnerable:
Run 'containerd --version' and compare against affected version ranges; check if CRI is enabled in containerd config.Check Version:
containerd --versionVerify Fix Applied:
Confirm version is 1.7.29+, 2.0.7+, 2.1.5+, or 2.2.0+; monitor for goroutine leaks during attach operations.📡 Detection & Monitoring
Log Indicators:
- Unusual number of goroutines in containerd logs
- Memory exhaustion warnings
- Failed attach operations with resource errors
Network Indicators:
- High frequency of attach API calls from single source
- Abnormal Kubernetes API request patterns
SIEM Query:
source="containerd" AND ("goroutine" OR "memory" OR "attach") AND ("error" OR "warning" OR "exhaust")