SB2023040489 - Multiple vulnerabilities in CRI-O

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2022-4318)

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to improper input validation when handling newline characters in environment variables. A local user can create a specially crafted environment variable and add entries to a container's /etc/passwd. It is also possible to circumvent admission validation of username/UID by adding such an entry.

2) Improper access control (CVE-ID: CVE-2022-2995)

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to incorrect handling of the supplementary groups. A local user can bypass implemented security restrictions, leading to sensitive information disclosure or possible data modification.

Remediation

Install update from vendor's website.

References

• https://github.com/cri-o/cri-o/releases/tag/v1.24.5
• https://github.com/cri-o/cri-o/releases/tag/v1.25.3