Description
A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | CRI-O | cri-o 1.24.0, cri-o 1.23.2, cri-o 1.22.3, cri-o 1.21.6, cri-o 1.20.7, cri-o 1.19.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.19.5-3.rhaos4.6.git91f8458.el7 | RHSA-2022:0871, RHSA-2022:0870, RHSA-2022:0866 |
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.8.1646993358-1.el8 | RHSA-2022:0871 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | cri-o | 1.23.2-r0 | — |
| Alpine v3.23 | cri-o | 1.23.2-r0 | — |
| Alpine v3.22 | cri-o | 1.23.2-r0 | — |
| Alpine v3.21 | cri-o | 1.23.2-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | cri-o | 1.22.3-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | cri-o | 1.20.7-1.el8 | ELSA-2022-9229, ELSA-2022-9228 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
spiarh/webhook-cve-2022-0811 ★ 8 · Mar 21, 2022
Simple webhook to block exploitation of CVE-2022-0811
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cri-o/cri-o | >= 1.19.0, < 1.19.6 | 1.19.6 | GHSA-6x2m-w449-qwx7 |
| Go | github.com/cri-o/cri-o | >= 1.20.0, < 1.20.7 | 1.20.7 | GHSA-6x2m-w449-qwx7 |
| Go | github.com/cri-o/cri-o | >= 1.21.0, < 1.21.6 | 1.21.6 | GHSA-6x2m-w449-qwx7 |
| Go | github.com/cri-o/cri-o | >= 1.22.0, < 1.22.3 | 1.22.3 | GHSA-6x2m-w449-qwx7 |
| Go | github.com/cri-o/cri-o | >= 1.23.0, < 1.23.2 | 1.23.2 | GHSA-6x2m-w449-qwx7 |
| Go | github.com/cri-o/cri-o | >= 1.19.0, < 1.19.6 · >= 1.20.0, < 1.20.7 · >= 1.21.0, < 1.21.6 · >= 1.22.0, < 1.22.3 · >= 1.23.0, < 1.23.2 | 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2 | GO-2022-0354 |
Advisories 7
- RHSA-2022:0871 Red Hat Security Advisory: OpenShift Container Platform 4.8.35 security update Red Hat Security Advisories (RHSA) · Mar 21, 2026
- RHSA-2022:0866 Red Hat Security Advisory: OpenShift Container Platform 4.6.56 packages and security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:0870 Red Hat Security Advisory: OpenShift Container Platform 4.7.45 packages and security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:0860 Red Hat Security Advisory: OpenShift Container Platform 4.9.25 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:0810 Red Hat Security Advisory: OpenShift Container Platform 4.10.4 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2022-9229 Important: cri-o security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 18, 2022
- ELSA-2022-9228 Important: cri-o security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 18, 2022