SB2023040489 - Multiple vulnerabilities in CRI-O

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2022-4318)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to improper input validation when handling newline characters in environment variables. A local user can create a specially crafted environment variable and add entries to a container's /etc/passwd. It is also possible to circumvent admission validation of username/UID by adding such an entry.

2) Improper access control (CVE-ID: CVE-2022-2995)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to incorrect handling of the supplementary groups. A local user can bypass implemented security restrictions, leading to sensitive information disclosure or possible data modification.

Remediation

Install update from vendor's website.

References

• https://github.com/cri-o/cri-o/releases/tag/v1.24.5
• https://github.com/cri-o/cri-o/releases/tag/v1.25.3