Skip to main content

Allocation of Resources Without Limits or Throttling

CVE-2025-4437

Medium
5.7/10

Summary

There's a vulnerability in the CRI-O application where when container is launched with 'securityContext.runAsUser' specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire '/etc/passwd' file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a Denial-of-Service (DoS) can be achieved, possibly disrupting other pods and services running in the same host.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • LOW
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published