Resource exhaustion in CRI-O - CVE-2022-1708

Vulnerability identifier: #VU64008

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1708

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the ExecSync request. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

CRI-O
Oracle Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Containers
openSUSE Leap
cri-o (Red Hat package)
cri-tools (Red Hat package)
conmon (Red Hat package)
ignition (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
jenkins-2-plugins (Red Hat package)
openshift-clients (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
toolbox-tests
toolbox
udica
containernetworking-plugins
crun
runc
slirp4netns
oci-seccomp-bpf-hook
containers-common
skopeo-tests
skopeo
fuse-overlayfs
skuba-update
skuba
cri-o
cri-o-kubeadm-criconfig
buildah-tests
buildah
conmon
conmon-debuginfo
container-selinux
podman-docker
podman-tests
podman
podman-catatonit
podman-plugins
podman-remote
criu
python3-criu
crit
caasp-release
release-notes-caasp
libslirp
libslirp-devel
cockpit-podman
conmon
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Container Platform

Install updates from vendor's website.

CRI-O - addressed in versions 1.22.5, 1.23.3, 1.24.1
cri-o (Red Hat package) - addressed in versions 1.11.16-0.17.rhaos3.11.git4c0a8ad.el7, 1.19.7-2.rhaos4.6.git3c20b65.el7, 1.19.7-2.rhaos4.6.git3c20b65.el8, 1.20.8-3.rhaos4.7.gitb9df556.el7, 1.20.8-3.rhaos4.7.gitb9df556.el8, 1.21.8-3.rhaos4.8.gitd7fbb0d.el7, 1.21.8-3.rhaos4.8.gitd7fbb0d.el8, 1.22.5-3.rhaos4.9.gitb6d3a87.el7, 1.22.5-3.rhaos4.9.gitb6d3a87.el8, 1.23.3-3.rhaos4.10.git5fe1720.el8
cri-tools (Red Hat package) - addressed in versions 1.19.0-7.el8, 1.20.0-4.el8
conmon - update to 2.1.2
conmon (Red Hat package) - addressed in versions 2.0.21-3.rhaos4.6.el7, 2.0.21-3.rhaos4.6.el8, 2.0.29-3.rhaos4.7.el7, 2.0.29-3.rhaos4.7.el8, 2.0.29-3.rhaos4.8.el7, 2.0.29-3.rhaos4.8.el8, 2.0.29-3.rhaos4.9.el7, 2.0.29-3.rhaos4.9.el8, 2.0.29-3.rhaos4.10.el8
Red Hat Advanced Cluster Management for Kubernetes - update to 2.3.11
ignition (Red Hat package) - addressed in versions 2.6.0-9.rhaos4.6.git947598e.el8, 2.9.0-5.rhaos4.7.git1d56dc8.el8
Red Hat OpenShift Container Platform - addressed in versions 3.11.715, 4.6.59, 4.7.53, 4.8.43, 4.9.38, 4.10.18
atomic-openshift (Red Hat package) - update to 3.11.715-1.git.0.e449bb4.el7
openshift-ansible (Red Hat package) - update to 3.11.715-1.git.0.9151060.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.715-1.g99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.715-1.g13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.715-1.g39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.715-1.gf8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.715-1.gc8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.715-1.gf2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.715-1.ga7c5920.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.715-1.gd435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.715-1.g22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.715-1.gedebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.715-1.g609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.715-1.g2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.715-1.g99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.715-1.g0fa231c.el7
openshift-kuryr (Red Hat package) - update to 3.11.715-1.g0c4bf66.el7
openshift (Red Hat package) - addressed in versions 4.6.0-202205181042.p0.g8203b20.assembly.stream.el7, 4.6.0-202205181042.p0.g8203b20.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.6.1653312933-1.el8
openshift-clients (Red Hat package) - addressed in versions 4.8.0-202206010726.p0.g7c3760e.assembly.stream.el7, 4.8.0-202206010726.p0.g7c3760e.assembly.stream.el8
openstack-ironic-python-agent (Red Hat package) - update to 8.3.1-0.20220606104811.3c9b113.el8
toolbox-tests - update to 0.0.99.3-1.0.1
toolbox - update to 0.0.99.3-1.0.1
udica - update to 0.2.4-1.0.1
containernetworking-plugins - update to 0.9.1-1.0.1
crun - update to 0.18-3.0.1
runc - update to 1.0.0-73.rc95.0.1
slirp4netns - update to 1.1.8-1.0.1
oci-seccomp-bpf-hook - update to 1.2.0-3.0.1
containers-common - update to 1.2.4-2.0.1
skopeo-tests - update to 1.2.4-2.0.1
skopeo - update to 1.2.4-2.0.1
fuse-overlayfs - update to 1.4.0-2.0.1
skuba-update - update to 1.4.16-150100.3.65.1
skuba - update to 1.4.16-150100.3.65.1
cri-o - update to 1.19.7-150100.3.50.1
cri-o-kubeadm-criconfig - update to 1.19.7-150100.3.50.1
buildah-tests - update to 1.19.9-6.0.1
buildah - update to 1.19.9-6.0.1
conmon - update to 2.0.26-3.0.1
conmon - addressed in versions 2.1.3-150100.3.9.1, 2.1.5-150300.8.6.1, 2.1.5-150400.3.3.1
conmon-debuginfo - addressed in versions 2.1.3-150100.3.9.1, 2.1.5-150300.8.6.1, 2.1.5-150400.3.3.1
container-selinux - update to 2.189.0-1.0.1
podman-docker - update to 3.0.1-15.0.1
podman-tests - update to 3.0.1-15.0.1
podman - update to 3.0.1-15.0.1
podman-catatonit - update to 3.0.1-15.0.1
podman-plugins - update to 3.0.1-15.0.1
podman-remote - update to 3.0.1-15.0.1
criu - update to 3.15-1.0.1
python3-criu - update to 3.15-1.0.1
crit - update to 3.15-1.0.1
caasp-release - update to 4.2.9-150100.24.52.1
release-notes-caasp - update to 4.2.20220921-150100.4.80.1
libslirp - update to 4.3.1-1.0.1
libslirp-devel - update to 4.3.1-1.0.1
cockpit-podman - update to 29-2.0.1

• https://github.com/cri-o/cri-o/releases/tag/v1.22.5
• https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j

• Denial of service in cri-o
• Denial of service in OpenShift Container Platform 4.10
• Denial of service in conmon
• Denial of service in OpenShift Container Platform 4.9
• Denial of service in OpenShift Container Platform 4.7
• Denial of service in OpenShift Container Platform 4.8
• Multiple vulnerabilities in OpenShift Container Platform 4.6
• Red Hat OpenShift Container Platform 3.11 update for cri-o
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.3
• SUSE update for caasp-release, cri-o, patchinfo, release-notes-caasp, skuba
• SUSE update for conmon
• Red Hat Enterprise Linux 8 update for the container-tools:4.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:3.0 module
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• SUSE update for conmon
• SUSE update for conmon
• Multiple vulnerabilities in Oracle Linux
• Anolis OS update for container-tools:3.0 module