PT-2022-13244 · Cri-O+1 · Cri-O+1

Przemyslaw Roguski · Published 2020-05-06 · Updated 2024-08-21 · CVE-2022-0532

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions CRI-O versions 1.18 and earlier

Description An incorrect sysctls validation issue was found, allowing an attacker to apply sysctls from the list of "safe" sysctls specified for the cluster to the host if they can create a pod with a hostIPC and hostNetwork kernel namespace.

Recommendations For CRI-O versions 1.18 and earlier, as a temporary workaround, consider restricting the creation of pods with hostIPC and hostNetwork kernel namespace to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2020-1920

ALT-PU-2020-2425

CVE-2022-0532

GHSA-JQMC-79GX-7G8P

GO-2022-0608

RHSA-2022:0055

RHSA-2022:0866

RHSA-2022:0870

Affected Products

Alt Linux

Cri-O

References · 11

• https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2051730 · Patch
• https://osv.dev/vulnerability/CVE-2022-0532 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqmc-79gx-7g8p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0532 · Security Note
• https://osv.dev/vulnerability/GO-2022-0608 · Vendor Advisory
• https://github.com/cri-o/cri-o · Note
• https://github.com/cri-o/cri-o/pull/5610 · Note
• https://github.com/cri-o/cri-o/releases/tag/v1.23.1 · Note
• https://t.me/cvenotify/26931 · Telegram Post
• https://github.com/advisories/GHSA-jqmc-79gx-7g8p · Note