CME-704

cgroups v2 Resource Limits

Isolate OS/Kernel Unquantified evidence Preventive

Description

Constrains CPU, memory, I/O, and PIDs for process groups using cgroups v2 unified hierarchy. Prevents resource exhaustion attacks and limits blast radius of runaway or malicious processes.

CVSS Vector Impacts

Metric	Transition	Rationale
Availability (A)	H → L	Process cannot exhaust host resources; OOM killer scoped to cgroup

CWE Relationships

CWE-400 CWE-770 CWE-772 CWE-401

Verification

Check cgroup v2 is mounted and limits are set

$ mount | grep cgroup2
# Expected: cgroup2

Platform: linux

$ cat /sys/fs/cgroup/<slice>/memory.max
# Expected: numeric limit

Platform: linux

Remediation

linux cgroup v2 resource limits via systemd slice drop-in


mkdir -p /etc/systemd/system/<service>.service.d
printf '[Service]\nMemoryMax=512M\nMemoryHigh=384M\nCPUQuota=100%%\nTasksMax=256\n' > /etc/systemd/system/<service>.service.d/resource-limits.conf
systemctl daemon-reload
systemctl restart <service>

kubernetes Kubernetes container resource requests and limits


kubectl patch deployment <deployment> -n <namespace> --type=json -p '[{"op":"add","path":"/spec/template/spec/containers/0/resources","value":{"requests":{"cpu":"100m","memory":"128Mi"},"limits":{"cpu":"1","memory":"512Mi"}}}]'
kubectl apply -f - <<'EOF'
apiVersion: v1
kind: LimitRange
metadata:
  name: cme-704-defaults
  namespace: <namespace>
spec:
  limits:
  - default:
      cpu: "1"
      memory: 512Mi
    defaultRequest:
      cpu: 100m
      memory: 128Mi
    type: Container
EOF