PT-2022-7296 · Cri-O+2 · Cri-O+2

Sage Mctaggart · Published 2022-12-23 · Updated 2024-08-21 · CVE-2022-4318

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cri-o versions prior to 1.26.0

Description A vulnerability was found in cri-o, allowing the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. This issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For cri-o versions prior to 1.26.0, update to version 1.26.0 or later to resolve the issue. As a temporary workaround, consider using additional security controls like SELinux to prevent any damage a container is able to do with root on the host.

Fix

Weakness Enumeration

CWE-913

CWE-538

Related Identifiers

ALT-PU-2023-1519

ALT-PU-2023-1528

AZL-39873

BDU:2024-02430

CVE-2022-4318

GHSA-CM9X-C3RH-7RC4

GO-2022-1206

OESA-2024-1406

RHSA-2023:1033

RHSA-2023:1503

Affected Products

Alt Linux

Red Os

Cri-O

References · 27

• https://nvd.nist.gov/vuln/detail/CVE-2023-39325 · Security Note
• https://access.redhat.com/errata/RHSA-2023:1503 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:1033 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4318 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4318 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1406 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1206 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02430 · Security Note
• https://osv.dev/vulnerability/AZL-39873 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41723 · Security Note
• https://osv.dev/vulnerability/GHSA-cm9x-c3rh-7rc4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48795 · Security Note
• https://github.com/cri-o/cri-o · Note
• https://github.com/cri-o/cri-o/security/advisories/GHSA-cm9x-c3rh-7rc4 · Note
• https://github.com/cri-o/cri-o/pull/6450 · Note