CVE-2022-0532: Incorrect Permission Assignment for Critical Resource in CRI-O

February 11, 2022

An incorrect sysctls validation vulnerability was found in CRI-O. The sysctls from the list of “safe” sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

References

bugzilla.redhat.com/show_bug.cgi?id=2051730
github.com/advisories/GHSA-jqmc-79gx-7g8p
github.com/cri-o/cri-o/pull/5610
kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
nvd.nist.gov/vuln/detail/CVE-2022-0532

Code Behaviors & Features

Detect and mitigate CVE-2022-0532 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →