Input validation error in CRI-O - CVE-2022-4318

Vulnerability identifier: #VU70478

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-4318

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to improper input validation when handling newline characters in environment variables. A local user can create a specially crafted environment variable and add entries to a container's /etc/passwd. It is also possible to circumvent admission validation of username/UID by adding such an entry.

CRI-O
Red Hat OpenShift Container Platform
openEuler
cri-o-debugsource
cri-o-debuginfo
cri-o
cri-o (Red Hat package)
openshift (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)

Install updates from vendor's website.

CRI-O - addressed in versions 1.24.4, 1.26.0, 1.24.5, 1.25.3
Red Hat OpenShift Container Platform - addressed in versions 4.11.34, 4.12.6
cri-o-debugsource - update to 1.23.2-11
cri-o-debuginfo - update to 1.23.2-11
cri-o - update to 1.23.2-11
cri-o (Red Hat package) - addressed in versions 1.24.4-10.rhaos4.11.git1ed5ac5.el8, 1.25.2-9.rhaos4.12.git0a083f9.el9, 1.25.2-10.rhaos4.12.git0a083f9.el8
openshift (Red Hat package) - addressed in versions 4.11.0-202303240327.p0.gaf0420d.assembly.stream.el8, 4.12.0-202302211516.p0.g18eadca.assembly.stream.el8, 4.12.0-202302211516.p0.g18eadca.assembly.stream.el9
atomic-openshift-service-idler (Red Hat package) - update to 4.11.0-202303240327.p0.ga0f9090.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.11.0-202303240327.p0.g93daed6.assembly.stream.el8
openshift-ansible (Red Hat package) - update to 4.11.0-202303240327.p0.gdf73941.assembly.stream.el8
openshift-clients (Red Hat package) - update to 4.11.0-202303240327.p0.gdea6f47.assembly.stream.el8
kernel (Red Hat package) - update to 4.18.0-372.46.1.el8_6
kernel-rt (Red Hat package) - update to 4.18.0-372.46.1.rt7.203.el8_6

• https://github.com/cri-o/cri-o/security/advisories/GHSA-cm9x-c3rh-7rc4
• https://github.com/cri-o/cri-o/releases/tag/v1.24.4

• Security restrictions bypass in CRI-O
• Security restrictions bypass in OpenShift Container Platform 4.12
• Multiple vulnerabilities in CRI-O
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• OpenShift Container Platform 4.11 update for CRI-O
• openEuler 22.03 LTS SP1 update for cri-o