CVE-2022-27652: Incorrect Default Permissions in CRI-O
Summary
CVE-2022-27652: Incorrect Default Permissions in CRI-O. Affects github.com/cri-o/cri-o versions < 1.24.0. Fixed in 1.24.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CRI-O is an open-source container runtime for Kubernetes that provides an interface between Kubernetes and the container runtime. It allows users to run containers without the need for a full container orchestration platform. CRI-O is written in Go and is designed to be lightweight and secure. However, a vulnerability has been discovered in CRI-O that could allow unprivileged users and processes to gain elevated file capabilities within a container.
Vulnerability Detail
The vulnerability in CRI-O arises from containers being started with non-empty inheritable Linux process capabilities. This creates an atypical Linux environment and enables programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). Normally, unprivileged users and processes can execute executable programs with specified permitted file capabilities and gain those capabilities up to the bounding set. However, due to this bug, containers that include executable programs with inheritable file capabilities allow unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. This primarily affects containers that use Linux users and groups for privilege separation. The bug does not impact the container security sandbox as the inheritable set never contains more capabilities than the container's bounding set.
How To Fix
Minimum fixed version
1.24.0
This is the first release that contains the fix.
go get github.com/cri-o/cri-o@v1.24.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to modify the entrypoint of a container to use a utility like capsh(1) to drop inheritable capabilities before the primary process starts.
Conclusion
The vulnerability in CRI-O that allows unprivileged users and processes to gain elevated file capabilities within a container can be fixed by updating to CRI-O version 1.24.0 or later. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset. A workaround is available by modifying the container's entrypoint to drop inheritable capabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cri-o/cri-o →
FAQ
CRI-O is an open-source container runtime for Kubernetes that provides an interface between Kubernetes and the container runtime. It allows users to run containers without the need for a full container orchestration platform.
This vulnerability in CRI-O allows unprivileged users and processes to gain elevated file capabilities within a container. Containers that include executable programs with inheritable file capabilities are affected.
The impact of this vulnerability is that unprivileged users and processes can gain additional inheritable file capabilities within a container, potentially allowing them to perform privileged actions.
To fix this vulnerability, update to CRI-O version 1.24.0 or later. Stop, delete, and recreate running containers for the inheritable capabilities to be reset.
Yes, a workaround is to modify the entrypoint of a container to use a utility like capsh(1) to drop inheritable capabilities before the primary process starts.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cri-o/cri-o.
