CME-1010

cgroup Memory Pressure Monitoring (memory.events / PSI)

Description

Monitors cgroups v2 memory pressure signals — memory.events (oom_kill, high, max counters) and Pressure Stall Information (PSI) via /proc/pressure/memory — to detect resource leaks before they exhaust system memory. When a cgroup approaches its memory limit due to a resource leak, these interfaces provide deterministic signals (memory.high threshold crossings, oom_kill increments, PSI stall percentages) that monitoring systems consume to trigger alerts and automated remediation. Complements cgroup memory limits (CME-704) which contain the leak by adding detection of when containment is being stressed. The memory.events counters are monotonically increasing and per-cgroup, enabling precise attribution of pressure to the leaking workload.

CVSS Vector Impacts

Metric Transition Rationale
Attack Complexity (AC) L H Compensating control: cgroup memory pressure events (memory.events oom_kill/high counters and PSI stall metrics) provide deterministic early warning of resource leaks before system-wide exhaustion occurs, enabling operators to identify and remediate leaking processes within the monitoring interval — the attacker must exhaust resources faster than the monitoring and response cycle to achieve sustained denial of service.

CWE Relationships

Verification

Check that cgroup memory.events is accessible and PSI is enabled in the kernel

$ cat /sys/fs/cgroup/system.slice/memory.events
# Expected: Non-zero counters if pressure has occurred; file existence confirms cgroup v2 memory accounting is active
Platform: linux
$ cat /proc/pressure/memory
# Expected: PSI metrics present (some/full avg10/avg60/avg300 values); confirms CONFIG_PSI=y
Platform: linux
$ grep -c CONFIG_PSI=y /boot/config-$(uname -r)
# Expected: 1
Platform: linux
← CME-1009: Privilege Assignment Monitoring (Role Grant Alerting) CME-1101: Automated Patch Management (dnf-automatic) →