CVE-2021-32699: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings
Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to 1.4.4 are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding. Users should upgrade to 1.4.4 to mitigate the issue. There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-32699?
CVE-2021-32699 is a vulnerability in Pterodactyl Wings, the control plane software for the open source Pterodactyl game management system. The vulnerability allows a malicious user to consume more system resources than intended due to improper container process limits being defined.
What is the severity of CVE-2021-32699?
The severity of CVE-2021-32699 is medium with a CVSS score of 6.5.
How does CVE-2021-32699 impact Pterodactyl Wings?
CVE-2021-32699 can lead to system resource exhaustion in Pterodactyl Wings, allowing a malicious user to consume more resources than intended.
How can I fix CVE-2021-32699?
To fix CVE-2021-32699, upgrade to Pterodactyl Wings version 1.4.4 or newer.
Is there any reference documentation for CVE-2021-32699?
Yes, you can find reference documentation for CVE-2021-32699 at the following links: [GitHub Commit](https://github.com/pterodactyl/wings/commit/e0078eee0a71d61573a94c75e6efcad069d78de3) and [GitHub Security Advisory](https://github.com/pterodactyl/wings/security/advisories/GHSA-jj6m-r8jc-2gp7).