Listen to this Post
The vulnerability CVE-2025-64329 exists within the container runtime’s CRI (Container Runtime Interface) Attach implementation. When a user executes a command like `kubectl attach` to connect to a running container, the containerd process spawns a goroutine to handle the bidirectional stream of data between the user’s client and the container’s process. A flaw in the cleanup logic for these connections causes the goroutine to persist and remain in memory even after the attach session is terminated. An attacker can exploit this by repeatedly initiating and closing new attach sessions. Each failed or completed session leaks the associated goroutine and its allocated memory. Through sustained, repetitive attacks, this leads to a gradual accumulation of leaked goroutines, eventually exhausting the available memory on the host node, causing a Denial-of-Service (DoS) condition and potentially crashing the node or the containerd daemon itself.
Platform: Containerd
Version: < 1.6.33, < 1.7.20
Vulnerability: Goroutine Leak
Severity: Critical
date: 2025
Prediction: 2025-12-15
What Undercode Say:
`kubectl attach `
`kubectl get pods –all-namespaces`
`ps aux | grep containerd`
`kubectl top nodes`
`kubectl describe node `
How Exploit:
Malicious users run scripts that repeatedly call the CRI Attach API, such as through automated `kubectl attach` commands, without properly closing sessions. This creates a memory exhaustion attack, degrading node performance and causing system instability.
Protection from this CVE
Update containerd to versions 1.6.33 or 1.7.20. Implement a Kubernetes ValidatingAdmissionWebhook or Validating Admission Policy to restrict access to the `pods/attach` resource, limiting which users or service accounts can perform attach operations.
Impact:
Host memory exhaustion leading to a full Denial-of-Service (DoS) for the node, potentially crashing containers and disrupting all workloads on the affected host.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
