Database/Container, Kubernetes & orchestration
CRI-O: "Safe" sysctls applied to the host when a pod uses host IPC/network
CVSS 4.2CVE-2022-0532Container, Kubernetes & orchestrationcurated
Impact
"Safe" sysctls applied to the host when a pod uses host IPC/network
Who can reach it
Cluster user able to create a hostIPC pod
What to do
Upgrade CRI-O; block hostIPC/hostNetwork for tenants
References
Related entries
- CRI-O: Ambient-capability mishandling runs containers with elevated privilegesCVE-2018-1000400 · CRI-OHigh
- CRI-O: "cr8escape": kernel sysctl injection via pod spec gives container escape and arbitrary code executionCVE-2022-0811 · CRI-OHigh
- CRI-O: Malicious container creates a symlink via directory traversal and gets arbitrary host read/writeCVE-2024-5154 · CRI-OHigh
- CRI-O: Crafted environment variable injects arbitrary lines into /etc/passwdCVE-2022-4318 · CRI-OHigh
- CRI-O: Unbounded ExecSync output exhausts node memory or diskCVE-2022-1708 · CRI-OHigh
- CRI-O: Incorrect supplementary group handling leads to information disclosure between workloadsCVE-2022-2995 · CRI-OHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.