Vulnerability in CRI-O: Sysctls applied to containers with host IPC or host network namespaces can affect the host
Summary
GHSA-w2j5-3rcx-vx7x: Sysctls applied to containers with host IPC or host network namespaces can affect the host. Affects github.com/cri-o/cri-o across 5 version ranges.
>= 1.18.0, < 1.19.5
>= 1.20.0, < 1.20.6
>= 1.21.0, < 1.21.5
>= 1.22.0, < 1.22.2
>= 1.23.0, < 1.23.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CRI-O is an open-source implementation of the Kubernetes Container Runtime Interface (CRI) that provides a lightweight alternative to traditional container runtimes. It allows users to run containers directly from Kubernetes without the need for a full-fledged container runtime. CRI-O leverages the OCI (Open Container Initiative) runtime specification to manage containers and their lifecycles. However, a vulnerability has been discovered in CRI-O that can allow a malicious user to set sysctls on the host when containers with host IPC or host network namespaces are used.
Vulnerability Detail
The vulnerability arises from a bug in CRI-O's namespace creating tool, pinns, which is responsible for configuring the sysctls of the host. When a pod is using a host network or IPC namespace, pinns incorrectly configures the sysctls on the host instead of the pod's namespace. This means that a malicious user with access to hostNetwork and hostIPC can manipulate the sysctls on the host, potentially leading to unauthorized access or system compromise. The vulnerability affects CRI-O clusters after version 1.18, with versions 1.22 and 1.23 being vulnerable by default.
How To Fix
Latest published version: v1.37.2 as of 23 Oct 2026
go get github.com/cri-o/cri-o@v1.37.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.18.0, < 1.19.51.19.5go get github.com/cri-o/cri-o@v1.19.5 -
>= 1.20.0, < 1.20.61.20.6go get github.com/cri-o/cri-o@v1.20.6 -
>= 1.21.0, < 1.21.51.21.5go get github.com/cri-o/cri-o@v1.21.5 -
>= 1.22.0, < 1.22.21.22.2go get github.com/cri-o/cri-o@v1.22.2 -
>= 1.23.0, < 1.23.11.23.1go get github.com/cri-o/cri-o@v1.23.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the vulnerability in CRI-O versions 1.20 and 1.19, set the manage_ns_lifecycle option to false. This can be done by modifying the CRI-O configuration file and setting manage_ns_lifecycle: false. Alternatively, you can create an admission webhook that denies pods using host IPC or network namespaces and attempting to configure related sysctls. The webhook should be configured to reject such pods during the admission process.
Conclusion
The vulnerability in CRI-O that allows sysctls applied to containers with host IPC or host network namespaces to affect the host can be mitigated by updating to the latest patched versions or by applying the provided workarounds. It is recommended to update to CRI-O versions 1.24.0, 1.23.1, 1.22.2, 1.21.5, 1.20.6, or 1.19.5 to ensure the security of your CRI-O cluster. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cri-o/cri-o →
FAQ
CRI-O clusters after version 1.18 are affected by this vulnerability. Versions 1.22 and 1.23 are vulnerable by default.
The vulnerability allows a malicious user with access to hostNetwork and hostIPC to set sysctls on the host, potentially leading to unauthorized access or system compromise.
Yes, the CRI-O team has released patches for this vulnerability. Users are advised to update to CRI-O versions 1.24.0, 1.23.1, 1.22.2, 1.21.5, 1.20.6, or 1.19.5.
Yes, for CRI-O versions 1.20 and 1.19, you can set the manage_ns_lifecycle option to false. This allows the OCI runtime to configure the sysctls instead of pinns.
Yes, you can create an admission webhook that denies pods using host IPC or network namespaces and attempting to configure related sysctls. The webhook should be configured to reject such pods during the admission process.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cri-o/cri-o.
