CVE-2022-0811
High
Description
A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
SeverityHigh
CVSS8.8
Exploit probability—
ProductKubernetes Cri-o
PublishedMar 16, 2022
First seenMar 16, 2022
Weakness typeCWE-94Code injection
How to fix
Update
- kubernetes cri-o1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2 or later
- github.com/cri-o/cri-o1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kubernetes cri-o | 1.19.0 ≤ v < 1.19.6, 1.20.0 ≤ v < 1.20.7, 1.21.0 ≤ v < 1.21.6, 1.22.0 ≤ v < 1.22.3, 1.23.0 ≤ v < 1.23.2 | 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2 |
| github.com/cri-o/cri-oGo | 1.19.0 ≤ v < 1.19.6, 1.20.0 ≤ v < 1.20.7, 1.21.0 ≤ v < 1.21.6, 1.22.0 ≤ v < 1.22.3, 1.23.0 ≤ v < 1.23.2 | 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.