CRI-O: Malicious container creates a symlink via directory traversal and gets arbitrary host read/write

Impact

Malicious container creates a symlink via directory traversal and gets arbitrary host read/write

Who can reach it

Any tenant workload / malicious image

What to do

Upgrade CRI-O on all nodes; drain and recreate pods

References

Related entries

• CRI-O: Crafted environment variable injects arbitrary lines into /etc/passwdCVE-2022-4318 · CRI-OHigh
• CRI-O: Unbounded ExecSync output exhausts node memory or diskCVE-2022-1708 · CRI-OHigh
• CRI-O: Incorrect supplementary group handling leads to information disclosure between workloadsCVE-2022-2995 · CRI-OHigh
• CRI-O: Containers started with non-empty default inheritable capabilitiesCVE-2022-27652 · CRI-OMedium
• CRI-O: All pod processes share one memory cgroup, so a workload OOM kills conmon and destabilises the nodeCVE-2019-14891 · CRI-OMedium
• CRI-O: Shipped OpenShift CRI-O builds regressed the CVE-2022-2995 fixCVE-2022-3466 · CRI-OMedium