cgroup Memory Pressure Monitoring (memory.events / PSI)
Description
Monitors cgroups v2 memory pressure signals — memory.events (oom_kill, high, max counters) and Pressure Stall Information (PSI) via /proc/pressure/memory — to detect resource leaks before they exhaust system memory. When a cgroup approaches its memory limit due to a resource leak, these interfaces provide deterministic signals (memory.high threshold crossings, oom_kill increments, PSI stall percentages) that monitoring systems consume to trigger alerts and automated remediation. Complements cgroup memory limits (CME-704) which contain the leak by adding detection of when containment is being stressed. The memory.events counters are monotonically increasing and per-cgroup, enabling precise attribution of pressure to the leaking workload.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Compensating control: cgroup memory pressure events (memory.events oom_kill/high counters and PSI stall metrics) provide deterministic early warning of resource leaks before system-wide exhaustion occurs, enabling operators to identify and remediate leaking processes within the monitoring interval — the attacker must exhaust resources faster than the monitoring and response cycle to achieve sustained denial of service. |
CWE Relationships
Verification
Check that cgroup memory.events is accessible and PSI is enabled in the kernel
# Expected: Non-zero counters if pressure has occurred; file existence confirms cgroup v2 memory accounting is active
# Expected: PSI metrics present (some/full avg10/avg60/avg300 values); confirms CONFIG_PSI=y
# Expected: 1