Description
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cri-o | 1.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | coreos-installer +1 | 0.12.0-1.rhaos4.10.el8 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | cri-o | 1.19.5-3.rhaos4.6.git91f8458.el7 | RHSA-2022:0870, RHSA-2022:0866, RHSA-2022:0055 |
| Red Hat OpenShift 4 | jenkins | 2.319.2.1643288987-1.el8 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.10.1643404185-1.el8 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | openshift +1 | 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 | RHSA-2022:0055 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 | RHSA-2022:0055 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cri-o/cri-o | < 1.23.1 | 1.23.1 | GHSA-jqmc-79gx-7g8p |
Advisories 5
- RHSA-2022:0055 Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update Red Hat Security Advisories (RHSA) · Aug 20, 2026
- RHSA-2022:0866 Red Hat Security Advisory: OpenShift Container Platform 4.6.56 packages and security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:0870 Red Hat Security Advisory: OpenShift Container Platform 4.7.45 packages and security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHBA-2022:0793 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.8.34 packages update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHBA-2022:0794 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.9.24 packages update Red Hat Security Advisories (RHSA) · Nov 22, 2025