CVE-2025-64329

Executive Summary

CVE-2025-64329 is a denial-of-service vulnerability in the containerd container runtime, affecting versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1. The vulnerability resides in the CRI Attach implementation, where a user can exhaust host memory by triggering goroutine leaks. This is a local attack vector requiring low privileges, with a CVSS score of 0.0 (likely uncalculated or placeholder). The EPSS score is 0.0%, indicating low exploitation probability currently, but the risk is significant for multi-tenant environments. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability affects the containerd package, which is a core component of container orchestration platforms like Kubernetes. Organizations using containerd as their container runtime should prioritize patching, as the vulnerability can lead to host memory exhaustion and denial of service. The fix is available in versions 1.7.29, 2.0.7, 2.1.5, and 2.2.0.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - Requires local access to the container runtime.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires a user with pod attach permissions.
• User Interaction (UI): None (N) - No user interaction needed.
• Scope (S): Unchanged (U) - The vulnerability affects the host system.
• Confidentiality (C): None (N) - No data exposure.
• Integrity (I): None (N) - No data modification.
• Availability (A): High (H) - Memory exhaustion leads to denial of service.

Threat Level: Medium (due to local access requirement but high availability impact).

Deep Dive & Mechanics

The vulnerability is in the CRI (Container Runtime Interface) Attach functionality. When a user attaches to a container's stdin/stdout/stderr, containerd spawns goroutines to handle the I/O streams. Due to improper cleanup, these goroutines can leak if the attach session is terminated abnormally or if multiple attach requests are made in rapid succession. Each leaked goroutine consumes memory, and repeated exploitation can exhaust the host's memory, causing a denial of service for all containers on the host.

The bug is in the pkg/cri/server/attach.go file, where the goroutine lifecycle is not properly managed. Specifically, when a client disconnects without properly closing the stream, the goroutine handling the stream does not exit, leading to accumulation.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

func (s *Server) Attach(ctx context.Context, req *runtime.AttachRequest) (*runtime.AttachResponse, error) {
    // ... setup ...
    go func() {
        // This goroutine handles I/O but does not check for context cancellation
        io.Copy(stdin, req.Stdin)
    }()
    // ... return response ...
}

Patched Code (simplified):

func (s *Server) Attach(ctx context.Context, req *runtime.AttachRequest) (*runtime.AttachResponse, error) {
    // ... setup ...
    go func() {
        select {
        case <-ctx.Done():
            return
        default:
            io.Copy(stdin, req.Stdin)
        }
    }()
    // ... return response ...
}

The fix adds context cancellation checks to ensure goroutines exit when the client disconnects or the context is cancelled.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a container with kubectl attach permissions.
• Target containerd version within vulnerable range.

Exploitation Steps:

1. Identify a running pod: kubectl get pods
2. Repeatedly attach and detach: for i in {1..1000}; do kubectl attach <pod-name> -c <container-name> & sleep 0.1; kill %1; done
3. Monitor host memory: free -h or top
4. Continue until host memory is exhausted.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor for rapid attach/detach sequences in audit logs.
• Set resource limits on pods to prevent memory exhaustion.
• Use admission controllers to restrict attach permissions.

Hunting:

• Look for high goroutine counts in containerd processes: ps aux | grep containerd
• Check for memory pressure alerts on nodes.

Indicators of Compromise (IOCs)

• Network: No specific network IOCs.
• Host: High memory usage by containerd process, excessive goroutine count.
• Logs: Repeated attach/detach events in Kubernetes audit logs.
• File: No file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_64329_Containerd_Goroutine_Leak {
    meta:
        description = "Detects containerd binaries vulnerable to CVE-2025-64329"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64329"
    strings:
        $vuln_func = "Attach" ascii wide nocase
        $vuln_pattern = "io.Copy" ascii wide
    condition:
        $vuln_func and $vuln_pattern
}

Sigma Rule

title: Containerd Goroutine Leak Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects rapid attach/detach sequences to containerd
author: Valters IT
date: 2025-04-10
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        verb: "attach"
        objectRef.resource: "pods"
    timeframe: 5s
    condition: selection | count() > 10
falsepositives:
    - Legitimate debugging sessions
level: medium

Suricata Rule

alert tcp any any -> any 10250 (msg:"CVE-2025-64329 Containerd Attach Flood"; flow:to_server; content:"attach"; nocase; threshold: type both, track by_src, count 10, seconds 5; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade containerd to versions 1.7.29, 2.0.7, 2.1.5, or 2.2.0.
• Apply admission controller to restrict pods/attach resources.

Long-term:

• Implement resource quotas and limits on pods.
• Monitor goroutine counts in containerd processes.
• Regularly update container runtime components.

Workaround:

• Use admission webhooks to control attach access.

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation is illegal.