CVE-2023-6476
Fixed in a distro release EPSS <1%CVSS 6.5
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
Products: Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 3.11
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/cri-o/cri-o | 1.29.1 |
| Go | github.com/cri-o/cri-o | 1.28.3 |
| Go | github.com/cri-o/cri-o | 1.27.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 4.13 | cri-o | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 |
| Red Hat openshift 4.13 | cri-o | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 |
| Red Hat openshift 4.13 | cri-o-debuginfo | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 |
| Red Hat openshift 4.13 | cri-o-debuginfo | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 |
| Red Hat openshift 4.13 | cri-o-debugsource | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 |
| Red Hat openshift 4.13 | cri-o-debugsource | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 |
| Red Hat openshift 4.14 | cri-o | 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 |
| Red Hat openshift 4.14 | cri-o | 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 |
| Red Hat openshift 4.14 | cri-o-debuginfo | 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 |
| Red Hat openshift 4.14 | cri-o-debuginfo | 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 |
| Red Hat openshift 4.14 | cri-o-debugsource | 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 |
| Red Hat openshift 4.14 | cri-o-debugsource | 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 |