Search for packages
| purl | pkg:rpm/redhat/cri-o@1.19.5-3.rhaos4.6.git91f8458?arch=el7 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-11cw-axj8-vkdz
Aliases: CVE-2022-0811 GHSA-6x2m-w449-qwx7 |
Code Injection in CRI-O ### Impact A flaw introduced in CRI-O version 1.19 which an attacker can use to bypass the safeguards and set arbitrary kernel parameters on the host. As a result, anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime can abuse the `kernel.core_pattern` kernel parameter to achieve container escape and arbitrary code execution as root on any node in the cluster. ### Patches The patches will be present in 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2, 1.24.0 ### Workarounds - Users can set manage_ns_lifecycle to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option. - An admission webhook could be created to deny pods that specify a `+` in the sysctl value of a pod. - A [PodSecurityPolicy](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy) [deprecated] could be created, specifying all sysctls as forbidden like so: ``` apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: sysctl-psp spec: forbiddenSysctls: - "*" ``` However, this option will not work if any sysctls are required by any pods in the cluster. ### Credits Credit for finding this vulnerability goes to John Walker and Manoj Ahuje of Crowdstrike. The CRI-O community deeply thanks them for the report. ### For more information If you have any questions or comments about this advisory: * Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues) * To make a report, email your vulnerability to the private [cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list with the security details and the details expected for [all CRI-O bug reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml). | There are no reported fixed by versions. |
|
VCID-s6sw-jsfr-xyhv
Aliases: CVE-2022-0532 GHSA-jqmc-79gx-7g8p |
Incorrect Permission Assignment for Critical Resource in CRI-O An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T13:59:48.326900+00:00 | RedHat Importer | Affected by | VCID-s6sw-jsfr-xyhv | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-0532.json | 38.0.0 |
| 2026-04-01T13:59:11.009394+00:00 | RedHat Importer | Affected by | VCID-11cw-axj8-vkdz | https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-0811.json | 38.0.0 |