CVE-2022-0532
Fixed in a distro release EPSS <1%
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
Products: kubernetes cri-o, redhat openshift_container_platform
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cri-o/cri-o | 1.23.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.10 | coreos-installer | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-bootinfra | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-bootinfra-debuginfo | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-debuginfo | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-debugsource | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
| Red Hat openshift 4.10 | cri-o-debugsource | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | jenkins | 0:2.319.2.1643288987-1.el8 |
| Red Hat openshift 4.10 | jenkins-2-plugins | 0:4.10.1643404185-1.el8 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-clients-redistributable | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients-redistributable | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
| Red Hat openshift 4.6 | cri-o | 0:1.19.5-3.rhaos4.6.git91f8458.el8 |
| Red Hat openshift 4.6 | cri-o | 0:1.19.5-3.rhaos4.6.git91f8458.el7 |
| Red Hat openshift 4.6 | cri-o-debuginfo | 0:1.19.5-3.rhaos4.6.git91f8458.el8 |
| Red Hat openshift 4.6 | cri-o-debuginfo | 0:1.19.5-3.rhaos4.6.git91f8458.el7 |
| Red Hat openshift 4.6 | cri-o-debugsource | 0:1.19.5-3.rhaos4.6.git91f8458.el8 |
| Red Hat openshift 4.7 | cri-o | 0:1.20.6-11.rhaos4.7.git76ea3d0.el7 |
| Red Hat openshift 4.7 | cri-o | 0:1.20.6-11.rhaos4.7.git76ea3d0.el8 |
| Red Hat openshift 4.7 | cri-o-debuginfo | 0:1.20.6-11.rhaos4.7.git76ea3d0.el8 |
| Red Hat openshift 4.7 | cri-o-debuginfo | 0:1.20.6-11.rhaos4.7.git76ea3d0.el7 |
| Red Hat openshift 4.7 | cri-o-debugsource | 0:1.20.6-11.rhaos4.7.git76ea3d0.el8 |
| Red Hat openshift 4.8 | cri-o | 0:1.21.5-2.rhaos4.8.gitaf64931.el7 |
| Red Hat openshift 4.8 | cri-o | 0:1.21.5-2.rhaos4.8.gitaf64931.el8 |
| Red Hat openshift 4.8 | cri-o-debuginfo | 0:1.21.5-2.rhaos4.8.gitaf64931.el7 |
| Red Hat openshift 4.8 | cri-o-debuginfo | 0:1.21.5-2.rhaos4.8.gitaf64931.el8 |
| Red Hat openshift 4.8 | cri-o-debugsource | 0:1.21.5-2.rhaos4.8.gitaf64931.el8 |
| Red Hat openshift 4.9 | cri-o | 0:1.22.2-2.rhaos4.9.gitb030be8.el7 |
| Red Hat openshift 4.9 | cri-o | 0:1.22.2-2.rhaos4.9.gitb030be8.el8 |
| Red Hat openshift 4.9 | cri-o-debuginfo | 0:1.22.2-2.rhaos4.9.gitb030be8.el8 |
| Red Hat openshift 4.9 | cri-o-debuginfo | 0:1.22.2-2.rhaos4.9.gitb030be8.el7 |
| Red Hat openshift 4.9 | cri-o-debugsource | 0:1.22.2-2.rhaos4.9.gitb030be8.el8 |