Description
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 3.11 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 | RHSA-2024:0207, RHSA-2024:0195 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | cri-o | 1.22.3-10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cri-o/cri-o | >= 1.29.0, < 1.29.1 | 1.29.1 | GHSA-p4rx-7wvg-fwrc |
| Go | github.com/cri-o/cri-o | >= 1.28.0, < 1.28.3 | 1.28.3 | GHSA-p4rx-7wvg-fwrc |
| Go | github.com/cri-o/cri-o | < 1.27.3 | 1.27.3 | GHSA-p4rx-7wvg-fwrc |
| Go | github.com/cri-o/cri-o | < 1.27.3 · >= 1.28.0, < 1.28.3 · >= 1.29.0, < 1.29.1 | 1.27.3, 1.28.3, 1.29.1 | GO-2024-2458 |
Advisories 3
- RHSA-2024:0207 Red Hat Security Advisory: OpenShift Container Platform 4.14.9 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:0195 Red Hat Security Advisory: OpenShift Container Platform 4.13.29 packages and security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- WID-SEC-2024-0137 Red Hat OpenShift Container Platform: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jun 4, 2025
References
- RHSA-2024:0195 vendor-advisory
- RHSA-2024:0207 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-6476 vdb-entry
- RHBZ#2253994 issue-tracking