CRI-O: All pod processes share one memory cgroup, so a workload OOM kills conmon and destabilises the node

Impact

All pod processes share one memory cgroup, so a workload OOM kills conmon and destabilises the node

Who can reach it

Any tenant workload

What to do

Upgrade CRI-O; drain node

References

Related entries

• CRI-O: Shipped OpenShift CRI-O builds regressed the CVE-2022-2995 fixCVE-2022-3466 · CRI-OMedium
• CRI-O: "Safe" sysctls applied to the host when a pod uses host IPC/networkCVE-2022-0532 · CRI-OMedium
• CRI-O: Ambient-capability mishandling runs containers with elevated privilegesCVE-2018-1000400 · CRI-OHigh
• CRI-O: "cr8escape": kernel sysctl injection via pod spec gives container escape and arbitrary code executionCVE-2022-0811 · CRI-OHigh
• CRI-O: Malicious container creates a symlink via directory traversal and gets arbitrary host read/writeCVE-2024-5154 · CRI-OHigh
• CRI-O: Crafted environment variable injects arbitrary lines into /etc/passwdCVE-2022-4318 · CRI-OHigh