Description
A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cri-o | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.14.12-15.dev.rhaos4.2.gita17905f.el8 | RHSA-2020:2776 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.248-1.git.0.92ee8ac.el7 | RHSA-2020:2992 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.11.248-1.git.1.cc96c2d.el7 | RHSA-2020:2992 |
| Red Hat OpenShift 3 | cri-o | 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7 | RHSA-2020:2992 |
Advisories 2
- RHSA-2020:2992 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:2776 Red Hat Security Advisory: OpenShift Container Platform 4.2.36 cri-o security update Red Hat Security Advisories (RHSA) · Nov 22, 2025