CVE-2022-0811
Fixed in a distro release EPSS 19%
A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
Products: kubernetes cri-o
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cri-o/cri-o | 1.19.6 |
| Go | github.com/cri-o/cri-o | 1.20.7 |
| Go | github.com/cri-o/cri-o | 1.21.6 |
| Go | github.com/cri-o/cri-o | 1.22.3 |
| Go | github.com/cri-o/cri-o | 1.23.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.10 | cri-o | 0:1.23.1-12.rhaos4.10.git1607c6e.el8 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.1-12.rhaos4.10.git1607c6e.el7 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.1-12.rhaos4.10.git1607c6e.el7 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.1-12.rhaos4.10.git1607c6e.el8 |
| Red Hat openshift 4.10 | cri-o-debugsource | 0:1.23.1-12.rhaos4.10.git1607c6e.el8 |
| Red Hat openshift 4.6 | cri-o | 0:1.19.5-3.rhaos4.6.git91f8458.el8 |
| Red Hat openshift 4.6 | cri-o | 0:1.19.5-3.rhaos4.6.git91f8458.el7 |
| Red Hat openshift 4.6 | cri-o-debuginfo | 0:1.19.5-3.rhaos4.6.git91f8458.el8 |
| Red Hat openshift 4.6 | cri-o-debuginfo | 0:1.19.5-3.rhaos4.6.git91f8458.el7 |
| Red Hat openshift 4.6 | cri-o-debugsource | 0:1.19.5-3.rhaos4.6.git91f8458.el8 |
| Red Hat openshift 4.7 | cri-o | 0:1.20.6-11.rhaos4.7.git76ea3d0.el8 |
| Red Hat openshift 4.7 | cri-o | 0:1.20.6-11.rhaos4.7.git76ea3d0.el7 |
| Red Hat openshift 4.7 | cri-o-debuginfo | 0:1.20.6-11.rhaos4.7.git76ea3d0.el8 |
| Red Hat openshift 4.7 | cri-o-debuginfo | 0:1.20.6-11.rhaos4.7.git76ea3d0.el7 |
| Red Hat openshift 4.7 | cri-o-debugsource | 0:1.20.6-11.rhaos4.7.git76ea3d0.el8 |
| Red Hat openshift 4.8 | cri-o | 0:1.21.5-3.rhaos4.8.gitaf64931.el7 |
| Red Hat openshift 4.8 | cri-o | 0:1.21.5-3.rhaos4.8.gitaf64931.el8 |
| Red Hat openshift 4.8 | cri-o-debuginfo | 0:1.21.5-3.rhaos4.8.gitaf64931.el7 |
| Red Hat openshift 4.8 | cri-o-debuginfo | 0:1.21.5-3.rhaos4.8.gitaf64931.el8 |
| Red Hat openshift 4.8 | cri-o-debugsource | 0:1.21.5-3.rhaos4.8.gitaf64931.el8 |
| Red Hat openshift 4.8 | jenkins-2-plugins | 0:4.8.1646993358-1.el8 |
| Red Hat openshift 4.9 | cri-o | 0:1.22.2-3.rhaos4.9.gitb030be8.el8 |
| Red Hat openshift 4.9 | cri-o | 0:1.22.2-3.rhaos4.9.gitb030be8.el7 |
| Red Hat openshift 4.9 | cri-o-debuginfo | 0:1.22.2-3.rhaos4.9.gitb030be8.el8 |
| Red Hat openshift 4.9 | cri-o-debuginfo | 0:1.22.2-3.rhaos4.9.gitb030be8.el7 |
| Red Hat openshift 4.9 | cri-o-debugsource | 0:1.22.2-3.rhaos4.9.gitb030be8.el8 |