GHSA-6x2m-w449-qwx7

Suggest an improvement
Source
https://github.com/advisories/GHSA-6x2m-w449-qwx7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-6x2m-w449-qwx7/GHSA-6x2m-w449-qwx7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6x2m-w449-qwx7
Aliases
Published
2022-03-15T20:13:38Z
Modified
2023-11-08T04:07:40.724505Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Code Injection in CRI-O
Details

Impact

A flaw introduced in CRI-O version 1.19 which an attacker can use to bypass the safeguards and set arbitrary kernel parameters on the host. As a result, anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime can abuse the kernel.core_pattern kernel parameter to achieve container escape and arbitrary code execution as root on any node in the cluster.

Patches

The patches will be present in 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2, 1.24.0

Workarounds

  • Users can set managenslifecycle to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option.
  • An admission webhook could be created to deny pods that specify a + in the sysctl value of a pod.
  • A PodSecurityPolicy [deprecated] could be created, specifying all sysctls as forbidden like so:
    apiVersion: policy/v1beta1
    kind: PodSecurityPolicy
    metadata:
      name: sysctl-psp
    spec:
      forbiddenSysctls:
        - "*"
    
    However, this option will not work if any sysctls are required by any pods in the cluster.

Credits

Credit for finding this vulnerability goes to John Walker and Manoj Ahuje of Crowdstrike. The CRI-O community deeply thanks them for the report.

For more information

If you have any questions or comments about this advisory: * Open an issue in the CRI-O repo * To make a report, email your vulnerability to the private cncf-crio-security@lists.cncf.io list with the security details and the details expected for all CRI-O bug reports.

References

Affected packages

Go / github.com/cri-o/cri-o

Package

Name
github.com/cri-o/cri-o
View open source insights on deps.dev
Purl
pkg:golang/github.com/cri-o/cri-o

Affected ranges

Type
SEMVER
Events
Introduced
1.19.0
Fixed
1.19.6

Go / github.com/cri-o/cri-o

Package

Name
github.com/cri-o/cri-o
View open source insights on deps.dev
Purl
pkg:golang/github.com/cri-o/cri-o

Affected ranges

Type
SEMVER
Events
Introduced
1.20.0
Fixed
1.20.7

Go / github.com/cri-o/cri-o

Package

Name
github.com/cri-o/cri-o
View open source insights on deps.dev
Purl
pkg:golang/github.com/cri-o/cri-o

Affected ranges

Type
SEMVER
Events
Introduced
1.21.0
Fixed
1.21.6

Go / github.com/cri-o/cri-o

Package

Name
github.com/cri-o/cri-o
View open source insights on deps.dev
Purl
pkg:golang/github.com/cri-o/cri-o

Affected ranges

Type
SEMVER
Events
Introduced
1.22.0
Fixed
1.22.3

Go / github.com/cri-o/cri-o

Package

Name
github.com/cri-o/cri-o
View open source insights on deps.dev
Purl
pkg:golang/github.com/cri-o/cri-o

Affected ranges

Type
SEMVER
Events
Introduced
1.23.0
Fixed
1.23.2