CVE-2022-0811

A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.

Affected products

Alt Linux, Cri-O, Kubernetes

Kubernetes Cri-o

< 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2

Fix

Available

CVSS 2.0

9.0 HIGH

CVSS 3.1

8.8 HIGH

EPSS

19.0% (97th percentile)

Weakness

CWE-94

NVD status

Modified

Published

2022-03-16