containerd CRI ExecSync Goroutine Leak Causes Node-Level Denial of Service

According to the GitHub Security Advisory database, containerd versions prior to 2.3.5, 2.2.8, 2.0.12, and 1.7.35 are affected by a medium-severity issue where the CRI ExecSync implementation can lead to a node-level denial of service. This occurs due to a goroutine leak caused by exec probes and lifecycle hooks that spawn long-lived background child processes. The I/O drain phase lacks a timeout or context cancellation, allowing repeated invocations to exhaust host memory and eventually cause the containerd daemon to be terminated by the OOM killer. This issue impacts Linux systems running containerd with the CRI plugin enabled.

Operators should verify whether their containerd deployment uses the CRI plugin and whether exec probes or lifecycle hooks in their workloads involve background processes. If these conditions are met, upgrading to one of the patched versions is critical to avoid resource exhaustion. Additionally, operators should audit their workloads to ensure compliance with the workaround, which involves avoiding long-lived background child processes in probes and hooks. This advisory highlights the importance of timeout and cancellation mechanisms in resource management, a recurring theme in container runtime security.