PT-2022-1850 · Cri-O+2 · Cri-O+2

John Walker + 1 · Published 2022-03-15 · Updated 2025-07-06 · CVE-2022-0811

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CRI-O versions 1.19 through 1.23.1 CRI-O versions prior to 1.19.6 CRI-O versions prior to 1.20.7 CRI-O versions prior to 1.21.6 CRI-O versions prior to 1.22.3 CRI-O versions prior to 1.23.2 CRI-O version 1.24.0 and earlier

Description A flaw was found in CRI-O in the way it set kernel options for a pod, allowing anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node. The issue is related to the lack of proper validation of kernel parameters, which can be exploited by an attacker to bypass safeguards and set arbitrary kernel parameters on the host. This can lead to container escape and arbitrary code execution as root on any node in the cluster.

Recommendations For CRI-O versions 1.19 through 1.23.1, update to version 1.23.2 or later to fix the issue. For CRI-O versions prior to 1.19.6, update to version 1.19.6 or later to fix the issue. For CRI-O versions prior to 1.20.7, update to version 1.20.7 or later to fix the issue. For CRI-O versions prior to 1.21.6, update to version 1.21.6 or later to fix the issue. For CRI-O versions prior to 1.22.3, update to version 1.22.3 or later to fix the issue. For CRI-O versions prior to 1.23.2, update to version 1.23.2 or later to fix the issue. For CRI-O version 1.24.0 and earlier, update to a version later than 1.24.0 to fix the issue. As a temporary workaround, consider setting manage ns lifecycle to false, which causes the sysctls to be configured by the OCI runtime, or creating an admission webhook to deny pods that specify a + in the sysctl value of a pod.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALT-PU-2022-1490

ALT-PU-2022-1534

ALT-PU-2022-1565

ALT-PU-2022-1573

AZL-37070

BDU:2022-01319

CVE-2022-0811

ELSA-2022-9228

ELSA-2022-9229

GHSA-6X2M-W449-QWX7

GO-2022-0354

RHSA-2022:0810

RHSA-2022:0860

RHSA-2022:0866

RHSA-2022:0870

RHSA-2022:0871

Affected Products

Alt Linux

Cri-O

Kubernetes

References · 38

• 🔥 https://github.com/spiarh/webhook-cve-2022-0811 · Exploit
• https://linux.oracle.com/errata/ELSA-2022-9229.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01319 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0811 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0354 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-37070 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0811 · Security Note
• https://osv.dev/vulnerability/GHSA-6x2m-w449-qwx7 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9228.html · Vendor Advisory
• https://github.com/cri-o/cri-o/security/advisories/GHSA-6x2m-w449-qwx7 · Note
• https://github.com/cri-o/cri-o · Note
• https://github.com/cri-o/cri-o/releases · Note
• https://github.com/Cloud-Architekt/AzureAD-Attack-Defense · Note
• https://twitter.com/linux_ly/status/1842835634165362804 · Twitter Post
• https://t.me/defcon_news/98220 · Telegram Post