GitHub Advisoryadvisory · Go

GHSA-jqmc-79gx-7g8p Incorrect Permission Assignment for Critical Resource in CRI-O

MEDIUM Published 2022-02-11 Modified 2022-02-23 Official page ↗
Aliases
CVE-2022-0532
Ecosystem
Go
Packages
github.com/cri-o/cri-o
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
Weaknesses
CWE-732
Reviewed
2022-02-11

Affected packages

• Go github.com/cri-o/cri-o: < 1.23.1 → fixed in 1.23.1

Description

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Related

Alias · CVE (1)

  • CVE-2022-0532 An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References