CVE-2022-0532: Incorrect Permission Assignment for Critical Resource in CRI-O
Summary
CVE-2022-0532: Incorrect Permission Assignment for Critical Resource in CRI-O. Affects github.com/cri-o/cri-o versions < 1.23.1. Fixed in 1.23.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CRI-O is an open-source implementation of the Kubernetes Container Runtime Interface (CRI) that enables the running of containers on Kubernetes. It is written in Go and provides a lightweight alternative to traditional container runtimes. CRI-O allows users to create and manage pods, containers, and images within a Kubernetes cluster. However, a vulnerability has been discovered in CRI-O versions 1.18 and earlier that could lead to incorrect permission assignment for a critical resource.
Vulnerability Detail
The vulnerability in CRI-O arises from an incorrect sysctls validation process. When an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace, the sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host. This means that an attacker with the ability to create such a pod can potentially modify critical system settings on the host, leading to unauthorized access or disruption of the host's functionality. The severity of this vulnerability is considered moderate, with a CVSS score of 4.2.
How To Fix
Minimum fixed version
1.23.1
This is the first release that contains the fix.
go get github.com/cri-o/cri-o@v1.23.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of CRI-O to mitigate the risk.
Conclusion
In conclusion, the vulnerability in CRI-O versions 1.18 and earlier allows an attacker to modify critical system settings on the host by creating a pod with specific kernel namespaces. To mitigate this risk, it is recommended to upgrade to CRI-O version 1.23.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cri-o/cri-o →
FAQ
CRI-O is an open-source implementation of the Kubernetes Container Runtime Interface (CRI) that allows the running of containers on Kubernetes.
CRI-O versions 1.18 and earlier are affected by this vulnerability.
An attacker who can create a pod with a hostIPC and hostNetwork kernel namespace can modify critical system settings on the host, potentially leading to unauthorized access or disruption of the host's functionality.
The severity of this vulnerability is considered moderate, with a CVSS score of 4.2.
No, there is no known workaround. It is crucial to upgrade to the fixed version of CRI-O.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cri-o/cri-o.
