Incorrect permission assignment for critical resource in CRI-O - CVE-2022-0532

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU68299

Incorrect permission assignment for critical resource in CRI-O - CVE-2022-0532

Published: October 13, 2022


Vulnerability identifier: #VU68299
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-0532
CWE-ID: CWE-732
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect sysctls validation in CRI-O. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.


Affected software

CRI-O
Red Hat OpenShift Container Platform
Migration Toolkit for Containers
openshift (Red Hat package)
openshift-ansible (Red Hat package)
ovn2.13 (Red Hat package)
toolbox (Red Hat package)
rust-bootupd (Red Hat package)
python-oslo-metrics (Red Hat package)
python-autopage (Red Hat package)
containernetworking-plugins (Red Hat package)
python-scciclient (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
console-login-helper-messages (Red Hat package)
python-hardware (Red Hat package)
python-openstacksdk (Red Hat package)
runc (Red Hat package)
skopeo (Red Hat package)
python-oslo-upgradecheck (Red Hat package)
fuse-overlayfs (Red Hat package)
crun (Red Hat package)
containers-common (Red Hat package)
buildah (Red Hat package)
cri-o (Red Hat package)
cri-tools (Red Hat package)
haproxy (Red Hat package)
python-debtcollector (Red Hat package)
kata-containers (Red Hat package)
python-osc-lib (Red Hat package)
python-oslo-service (Red Hat package)
python-tooz (Red Hat package)
python-proliantutils (Red Hat package)
ignition (Red Hat package)
openvswitch2.16 (Red Hat package)
jenkins (Red Hat package)
podman (Red Hat package)
python-sushy-oem-idrac (Red Hat package)
python-ironic-prometheus-exporter (Red Hat package)
python-cachetools (Red Hat package)
python-oslo-context (Red Hat package)
python-stevedore (Red Hat package)
python-oslo-policy (Red Hat package)
python-cliff (Red Hat package)
python-sushy (Red Hat package)
python-oslo-serialization (Red Hat package)
python-keystoneauth1 (Red Hat package)
python-oslo-concurrency (Red Hat package)
python-oslo-log (Red Hat package)
python-ironicclient (Red Hat package)
python-oslo-utils (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-clients (Red Hat package)
jenkins-2-plugins (Red Hat package)
python-oslo-i18n (Red Hat package)
python-ironic-lib (Red Hat package)
rust-afterburn (Red Hat package)
python-pbr (Red Hat package)
python-dracclient (Red Hat package)
openstack-ironic-python-agent (Red Hat package)
python-oslo-config (Red Hat package)
python-oslo-db (Red Hat package)
openstack-ironic-inspector (Red Hat package)
python-oslo-messaging (Red Hat package)
openstack-ironic (Red Hat package)
ovn21.09 (Red Hat package)
ovn-2021 (Red Hat package)
ovn21.12 (Red Hat package)
redhat-release-coreos (Red Hat package)
Red Hat OpenShift on IBM Cloud

How to mitigate CVE-2022-0532

Install updates from vendor's website.

CRI-O - update to 1.21.3
Red Hat OpenShift Container Platform - addressed in versions 4.8.34, 4.9.24, 4.10.3, 4.12.4
openshift (Red Hat package) - addressed in versions 4.8.0-202203040839.p0.g8a3bf4a.assembly.stream.el7, 4.8.0-202203040839.p0.g8a3bf4a.assembly.stream.el8, 4.9.0-202203012249.p0.g5c84e52.assembly.stream.el7, 4.9.0-202203012249.p0.g5c84e52.assembly.stream.el8, 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7, 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
openshift-ansible (Red Hat package) - addressed in versions 4.9.0-202203081819.p0.ge266b64.assembly.stream.el7, 4.10.0-202202110258.p0.g25af5a6.assembly.stream.el7
ovn2.13 (Red Hat package) - update to 20.12.0-195.el8fdp
toolbox (Red Hat package) - update to 0.0.8-4.rhaos4.10.el8
rust-bootupd (Red Hat package) - update to 0.2.5-3.rhaos4.10.el8
python-oslo-metrics (Red Hat package) - update to 0.3.0-0.20211020174122.43eee50.el8
python-autopage (Red Hat package) - update to 0.4.0-1.el8
containernetworking-plugins (Red Hat package) - update to 0.9.1-1.rhaos4.10.el8
python-scciclient (Red Hat package) - update to 0.11.1-0.20211208154124.a84332b.el8
coreos-installer (Red Hat package) - update to 0.12.0-1.rhaos4.10.el8
butane (Red Hat package) - update to 0.14.0-1.rhaos4.10.el8
console-login-helper-messages (Red Hat package) - update to 0.20.3-1.rhaos4.10.el8
python-hardware (Red Hat package) - update to 0.29.0-0.20211122094056.7662a1d.el8
python-openstacksdk (Red Hat package) - update to 0.59.0-0.20211012172340.d0d4d8b.el8
runc (Red Hat package) - addressed in versions 1.0.1-3.rhaos4.10.git4144b63.el7, 1.1.0-1.rhaos4.10.el8
skopeo (Red Hat package) - update to 1.2.2-1.rhaos4.10.el8
python-oslo-upgradecheck (Red Hat package) - update to 1.4.0-0.20211012144915.3ca8698.el8
fuse-overlayfs (Red Hat package) - update to 1.4.0-1.rhaos4.10.el8
crun (Red Hat package) - update to 1.4.2-1.rhaos4.10.el8
Migration Toolkit for Containers - update to 1.5.4
containers-common (Red Hat package) - update to 1-16.rhaos4.10.el8
buildah (Red Hat package) - update to 1.19.7-1.el8
cri-o (Red Hat package) - addressed in versions 1.21.5-2.rhaos4.8.gitaf64931.el7, 1.21.5-2.rhaos4.8.gitaf64931.el8, 1.22.2-2.rhaos4.9.gitb030be8.el7, 1.22.2-2.rhaos4.9.gitb030be8.el8, 1.23.0-92.rhaos4.10.gitdaab4d1.el7, 1.23.1-9.rhaos4.10.gitbdffb9a.el8
cri-tools (Red Hat package) - addressed in versions 1.23.0-1.el7, 1.23.0-1.el8
haproxy (Red Hat package) - update to 2.2.19-1.el8
python-debtcollector (Red Hat package) - update to 2.3.0-0.20211012161119.0bf5bf5.el8
kata-containers (Red Hat package) - update to 2.3.0-3.el8
python-osc-lib (Red Hat package) - update to 2.4.2-0.20211012163041.415a6c7.el8
python-oslo-service (Red Hat package) - update to 2.6.0-0.20211012154519.091fd65.el8
python-tooz (Red Hat package) - update to 2.9.0-0.20211012145018.174065f.el8
python-proliantutils (Red Hat package) - update to 2.12.2-0.20211210161243.500f518.el8
ignition (Red Hat package) - update to 2.13.0-2.rhaos4.10.el8
openvswitch2.16 (Red Hat package) - update to 2.16.0-33.el8fdp
jenkins (Red Hat package) - update to 2.319.2.1643288987-1.el8
podman (Red Hat package) - update to 3.0.1-7.rhaos4.10.el8
python-sushy-oem-idrac (Red Hat package) - update to 3.0.2-0.20211011174039.9733d23.el8
python-ironic-prometheus-exporter (Red Hat package) - update to 3.1.0-0.20211130174057.d25ba32.el8
python-cachetools (Red Hat package) - update to 3.1.0-2.el8ost
python-oslo-context (Red Hat package) - update to 3.3.1-0.20211012152439.641a1e0.el8
python-stevedore (Red Hat package) - update to 3.4.0-0.20211012153718.8846a3f.el8
python-oslo-policy (Red Hat package) - update to 3.8.2-0.20211012161944.c7fd9f4.el8
python-cliff (Red Hat package) - update to 3.9.0-0.20211020191737.734bc0c.el8
python-sushy (Red Hat package) - update to 4.0.0-0.20211209155954.45d24d4.el8
python-oslo-serialization (Red Hat package) - update to 4.2.0-0.20211012151454.2b94a4f.el8
python-keystoneauth1 (Red Hat package) - update to 4.4.0-0.20211012144044.112bcae.el8
python-oslo-concurrency (Red Hat package) - update to 4.4.1-0.20211012150632.8e08400.el8
python-oslo-log (Red Hat package) - update to 4.6.0-0.20211012154701.41c8807.el8
Red Hat OpenShift on IBM Cloud - addressed in versions 4.8.35 1550, 4.9.25 1532
python-ironicclient (Red Hat package) - update to 4.9.0-0.20211209154934.6f1be06.el8
python-oslo-utils (Red Hat package) - update to 4.10.0-0.20211012164840.2c74bb9.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.10.0-202202160023.p0.g39cfc66.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.10.0-202202160023.p0.ge77f917.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7, 4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
jenkins-2-plugins (Red Hat package) - update to 4.10.1643404185-1.el8
python-oslo-i18n (Red Hat package) - update to 5.1.0-0.20211012165753.b031d17.el8
python-ironic-lib (Red Hat package) - update to 5.1.0-0.20211209154936.731e2f9.el8
rust-afterburn (Red Hat package) - update to 5.2.0-1.rhaos4.10.el8
python-pbr (Red Hat package) - update to 5.5.1-1.el8ost
python-dracclient (Red Hat package) - update to 7.0.0-0.20211012182751.d26664e.el8
openstack-ironic-python-agent (Red Hat package) - update to 8.3.1-0.20220105174059.d2d3cd6.el8
python-oslo-config (Red Hat package) - update to 8.7.1-0.20211012155707.1a7bd66.el8
python-oslo-db (Red Hat package) - update to 9.1.0-0.20211020204148.be2cc6a.el8
openstack-ironic-inspector (Red Hat package) - update to 10.9.1-0.20220117094044.19e2592.el8
python-oslo-messaging (Red Hat package) - update to 12.9.1-0.20211020204149.f9de265.el8
openstack-ironic (Red Hat package) - update to 19.0.1-0.20220120204037.438b8af.el8
ovn21.09 (Red Hat package) - update to 21.09.0-22.el8fdp
ovn-2021 (Red Hat package) - update to 21.12.0-15.el8fdp
ovn21.12 (Red Hat package) - update to 21.12.0-25.el8fdp
redhat-release-coreos (Red Hat package) - update to 410.84-2.el8

External References

Related Security Bulletins