Incorrect default permissions in CRI-O - CVE-2022-27652

Vulnerability identifier: #VU62796

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27652

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to containers are incorrectly started with non-empty default permissions within in Moby (Docker Engine). An attacker with access to programs with inheritable file capabilities can elevate those capabilities to the permitted set when execve(2) runs.

CRI-O
jq (Red Hat package)
cri-o (Red Hat package)
python-boto (Red Hat package)
jenkins (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
ironic-images (Red Hat package)
Red Hat OpenShift Container Platform

Install update from vendor's website.

CRI-O - update to 1.24.0
jq (Red Hat package) - update to 1.6-2.el7
cri-o (Red Hat package) - addressed in versions 1.22.5-7.rhaos4.9.git3dbcd3c.el7, 1.22.5-7.rhaos4.9.git3dbcd3c.el8, 1.23.2-8.rhaos4.10.git8ad5d25.el8
python-boto (Red Hat package) - update to 2.34.0-5.el7
jenkins (Red Hat package) - update to 2.319.3.1650888800-1.el8
Red Hat OpenShift Container Platform - addressed in versions 4.9.41, 4.10.12, 4.12.0
openshift-clients (Red Hat package) - addressed in versions 4.9.0-202206240935.p0.g728b452.assembly.stream.el7, 4.9.0-202206240935.p0.g728b452.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.10.0-202204251639.p0.g70fb84c.assembly.stream.el7, 4.10.0-202204251639.p0.g70fb84c.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.10.1650890594-1.el8
openstack-ironic-python-agent (Red Hat package) - update to 8.1.1-0.20220623092113.0849a1b.el8
ironic-images (Red Hat package) - update to 2021.2-20220627.2.el8

• https://github.com/cri-o/cri-o/security/advisories/GHSA-4hj2-r2pm-3hc6
• https://bugzilla.redhat.com/show_bug.cgi?id=2066839

• Privilege escalation in cri-o
• Privilege escalation in OpenShift Container Platform 4.10
• Privilege escalation in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.12