Description
Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270) vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via container execution. This vulnerability appears to have been fixed in 1.9.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +13 | 3.9.30-1.git.0.dec1ba7.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | atomic-openshift-dockerregistry | 3.9.30-1.git.349.8b7912c.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.9.30-1.git.245.4a3aade.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | cri-o | 1.9.12-1.gitfa11beb.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | cri-tools | 1.0.0-5.rhaos3.9.git8e6013a.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | openshift-ansible +4 | 3.9.30-1.git.7.46f8678.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | prometheus-node-exporter +1 | 3.9.30-1.git.890.7ea5173.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-elasticsearch +1 | 1.16.1-1.el7 | RHBA-2018:1796 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-kubernetes_metadata_filter +1 | 1.0.3-1.el7 | RHBA-2018:1796 |
Advisories 1
- RHBA-2018:1796 Red Hat Bug Fix Advisory: OpenShift Container Platform 3.9 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026