Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2023-25153

Medium
5.5/10

Summary

Containerd is an open source container runtime. In versions through 1.5.17 and 1.6.0 through 1.6.17, and v1.7.0-beta.1 through v1.7.0-beta.3 when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a Denial of Service. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permission to import images.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published