CVE-2022-1708

    Dashboard / Vulnerabilities / CVE-2022-1708

    CVE-2022-1708

    Published: 7 Jun 2022Last Modified: 12 Aug 2026

    Summary:

    Details: A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1708.json, https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j, https://nvd.nist.gov/vuln/detail/CVE-2022-1708, https://bugzilla.redhat.com/show_bug.cgi?id=2085361, https://github.com/cri-o/cri-o/commit/f032cf649ecc7e0c46718bd9e7814bfb317cb544

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6becad23eadd7dfdd25fd8df386bf3b706cf7758
    Fixed -bd7ea645cd7436edd6a5a07b11559906032f124f

    Affected versions

    1.24.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1708 | CVE-DB