CVE-2021-23218 : Security Advisory and Response
Learn about CVE-2021-23218 involving a memory leak in Mirantis Container Runtime, impacting version 20.10.8 with FIPS mode enabled. Find out the impact, affected systems, and mitigation steps.
Mirantis Container Runtime version 20.10.8 with FIPS mode enabled experiences a memory leak during TLS Handshakes, potentially leading to a denial of service attack.
Understanding CVE-2021-23218
This vulnerability in Mirantis Container Runtime allows an attacker to exploit the memory leak when FIPS mode is enabled, affecting version 20.10.8.
What is CVE-2021-23218?
CVE-2021-23218 involves a memory leak issue in Mirantis Container Runtime (MCR) when operating in FIPS mode. The leakage occurs during TLS Handshakes, creating a potential avenue for a denial of service (DoS) attack.
The Impact of CVE-2021-23218
The impact of this vulnerability is rated as MEDIUM with a CVSS base score of 5.3. It could be abused by threat actors to disrupt the availability of services running Mirantis Container Runtime.
Technical Details of CVE-2021-23218
In this section, we delve into the specifics of the vulnerability, the affected systems, and how it can be exploited.
Vulnerability Description
The vulnerability arises due to improper memory handling during TLS Handshakes in Mirantis Container Runtime version 20.10.8 with FIPS mode enabled, leading to memory leaks.
Affected Systems and Versions
Mirantis Container Runtime version 20.10.8 is the specific version impacted by this vulnerability when running in FIPS mode.
Exploitation Mechanism
By exploiting the memory leak during TLS Handshakes, threat actors can trigger a DoS condition on systems running Mirantis Container Runtime.
Mitigation and Prevention
To address CVE-2021-23218 and enhance system security, take the following steps:
Immediate Steps to Take
Disable FIPS mode to prevent the memory leak issue and reduce the risk of a denial of service attack.
Long-Term Security Practices
Implement regular security updates, monitor for patches from Mirantis, and stay informed about vulnerabilities affecting Mirantis Container Runtime.
Patching and Updates
Stay updated with the latest patches and security advisories provided by Mirantis to mitigate the risk posed by CVE-2021-23218.