CVE-2025-64329: Containerd Memory Exhaustion DOS Vulnerability

CVE-2025-64329 Overview

CVE-2025-64329 is a memory exhaustion vulnerability in containerd, an open-source container runtime widely used by Kubernetes and other orchestration platforms. The flaw resides in the Container Runtime Interface (CRI) Attach implementation, where a goroutine leak allows a local user to consume host memory. Repeated invocations of the attach operation cause unbounded resource consumption, ultimately degrading or crashing the host. The issue is tracked as [CWE-401: Missing Release of Memory after Effective Lifetime].

Affected releases include containerd 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1. Fixed versions are 1.7.29, 2.0.7, 2.1.5, and 2.2.0.

Critical Impact

A local user with access to the pods/attach resource can exhaust host memory through repeated CRI Attach calls, causing denial of service on container hosts and Kubernetes nodes.

Affected Products

• containerd versions 1.7.28 and below
• containerd 2.0.0-beta.0 through 2.0.6, and 2.1.0-beta.0 through 2.1.4
• containerd 2.2.0-beta.0 through 2.2.0-rc.1

Discovery Timeline

• 2025-11-07 - CVE-2025-64329 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64329

Vulnerability Analysis

The vulnerability lives in containerd's CRI Attach code path, which allows callers to attach standard I/O streams to a running container. Each attach request spawns goroutines to shuttle data between the client and the container process. When the attach operation terminates abnormally or the caller disconnects, the spawned goroutines are not signaled to exit. These orphaned goroutines remain resident in the containerd process, holding references to buffers and channels that the Go runtime cannot garbage collect.

An attacker with permission to invoke pods/attach can repeatedly initiate and abandon attach sessions. Each iteration adds to the goroutine and memory footprint of the containerd daemon, eventually exhausting host memory. Because containerd typically runs as a privileged system service, memory pressure impacts every workload on the node.

Root Cause

The fix demonstrates the underlying defect: the attach path did not propagate a cancellation context.Context through to the I/O layer. Without context propagation, downstream goroutines had no mechanism to observe cancellation and terminate cleanly.

// internal/cri/server/container_attach.go
		},
	}
	// TODO(random-liu): Figure out whether we need to support historical output.
-	cntr.IO.Attach(opts)
+	cntr.IO.Attach(ctx, opts)
	return nil
}

Source: containerd commit 083b53c

The companion change in internal/cri/io/container_io.go imports the context package so the Attach implementation can honor cancellation:

// internal/cri/io/container_io.go
 package io

 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"

Source: containerd commit 083b53c

Attack Vector

Exploitation requires local access to the CRI socket or the Kubernetes API with rights to the pods/attach subresource. An authenticated user or compromised workload issues attach requests in a loop, terminating each session prematurely. Since no authentication weakness is required beyond the existing attach privilege, any principal already granted attach rights can trigger the condition.

Detection Methods for CVE-2025-64329

Indicators of Compromise

• Sustained growth in resident memory of the containerd process without a corresponding increase in running containers.
• Elevated goroutine counts visible via containerd's /debug/pprof/goroutine endpoint when debug is enabled.
• Repeated RuntimeService.Attach gRPC calls to the CRI socket from a single caller within short time windows.

Detection Strategies

• Audit Kubernetes API server logs for high-frequency pods/attach requests, particularly from service accounts or users that do not normally use interactive attach.
• Monitor node-level metrics for the containerd process, correlating memory growth against container churn to identify anomalous consumption patterns.
• Enable containerd debug endpoints in non-production environments and profile goroutine stacks for accumulations in the CRI I/O attach functions.

Monitoring Recommendations

• Alert on containerd RSS memory exceeding a baseline threshold sustained over 15 minutes.
• Track Kubernetes audit events for create verbs on the pods/attach subresource and rate-limit by principal.
• Feed container runtime telemetry into a SIEM or data lake to correlate attach activity with node memory pressure and OOM events.

How to Mitigate CVE-2025-64329

Immediate Actions Required

• Upgrade containerd to 1.7.29, 2.0.7, 2.1.5, or 2.2.0 on all Kubernetes nodes and standalone container hosts.
• Inventory RBAC bindings that grant access to the pods/attach subresource and remove permissions from principals that do not require interactive container access.
• Restart the containerd service after patching to release any accumulated leaked goroutines.

Patch Information

The fix is committed in containerd commit 083b53c and documented in GitHub Security Advisory GHSA-m6hq-p25p-ffr2. The patch threads a cancellation context through the CRI attach code path so that goroutines terminate when the client disconnects. Operators running distribution packages should apply vendor updates that ship the fixed containerd binary.

Workarounds

• Deploy a Kubernetes admission controller (for example, an OPA/Gatekeeper or Kyverno policy) that denies or restricts requests to the pods/attach resource.
• Restrict RBAC so only administrative service accounts can create pods/attach requests, eliminating exposure from general workload identities.
• Isolate the CRI socket with strict filesystem permissions to prevent non-root local users from invoking runtime services directly.

# Example Kyverno policy fragment restricting pods/attach
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-pod-attach
spec:
  validationFailureAction: Enforce
  rules:
    - name: block-attach
      match:
        any:
          - resources:
              kinds:
                - PodAttachOptions
      exclude:
        any:
          - subjects:
              - kind: Group
                name: system:masters
      validate:
        message: "pods/attach is restricted while CVE-2025-64329 mitigations are in place"
        deny: {}