CVE-2022-0811: Code Injection in CRI-O
Summary
CVE-2022-0811: Code Injection in CRI-O. Affects github.com/cri-o/cri-o across 5 version ranges.
>= 1.19.0, < 1.19.6
>= 1.20.0, < 1.20.7
>= 1.21.0, < 1.21.6
>= 1.22.0, < 1.22.3
>= 1.23.0, < 1.23.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CRI-O is an open-source container runtime for Kubernetes that provides a lightweight alternative to traditional container runtimes. It is written in Go and is designed to be compatible with the Open Container Initiative (OCI) standards. CRI-O allows users to deploy and manage containers on a Kubernetes cluster. However, a vulnerability has been discovered in CRI-O version 1.19 that allows an attacker to bypass safeguards and set arbitrary kernel parameters on the host. This can lead to container escape and arbitrary code execution as root on any node in the cluster.
Vulnerability Detail
The vulnerability in CRI-O version 1.19 allows an attacker with rights to deploy a pod on a Kubernetes cluster to abuse the kernel.core_pattern kernel parameter. By exploiting this flaw, an attacker can achieve container escape and execute arbitrary code as root on any node in the cluster. This can have severe consequences, as it grants the attacker full control over the affected system. The vulnerability was discovered by John Walker and Manoj Ahuje of Crowdstrike.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.19.0, < 1.19.61.19.6go get github.com/cri-o/cri-o@v1.19.6 -
>= 1.20.0, < 1.20.71.20.7go get github.com/cri-o/cri-o@v1.20.7 -
>= 1.21.0, < 1.21.61.21.6go get github.com/cri-o/cri-o@v1.21.6 -
>= 1.22.0, < 1.22.31.22.3go get github.com/cri-o/cri-o@v1.22.3 -
>= 1.23.0, < 1.23.21.23.2go get github.com/cri-o/cri-o@v1.23.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating CRI-O is not immediately feasible, there are a few workarounds that can mitigate the risk. Users can set manage_ns_lifecycle to false, which causes the sysctls to be configured by the OCI runtime, typically filtering these cases. This option is available in versions 1.20 and 1.19. Alternatively, an admission webhook can be created to deny pods that specify a + in the sysctl value. Another option is to create a PodSecurityPolicy that specifies all sysctls as forbidden. However, this may not be suitable if any sysctls are required by pods in the cluster.
Conclusion
The vulnerability in CRI-O version 1.19 allows an attacker to bypass safeguards and execute arbitrary code as root on any node in a Kubernetes cluster. It is crucial to update CRI-O to one of the patched versions or implement the recommended workarounds to ensure the security of the cluster. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cri-o/cri-o →
FAQ
CRI-O is an open-source container runtime for Kubernetes that provides a lightweight alternative to traditional container runtimes.
The vulnerability allows an attacker to bypass safeguards and execute arbitrary code as root on any node in a Kubernetes cluster that uses CRI-O version 1.19.
The vulnerability was discovered by John Walker and Manoj Ahuje of Crowdstrike.
To fix this vulnerability, update CRI-O to one of the patched versions: 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2, or 1.24.0.
Yes, there are workarounds available. Users can set manage_ns_lifecycle to false, create an admission webhook, or create a PodSecurityPolicy to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cri-o/cri-o.
