CVE-2019-14891: Medium severity cri-o vulnerability

Published Nov 7, 2019
·
Updated

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.

Other sources

Cri-o pods didn't provide sufficient isolation between the workload and infra containers such that when a workload consumed a large amount of memory, the kernel accidently killed the infra container's conmon process. An attacker would use the flaw to get host network access on an Kubernetes worker node.

Red Hat

Affected Software

8 affected componentsFixes available
redhat/cri-o<0:1.11.16-0.10.dev.rhaos3.11.git1eee681.el7
0:1.11.16-0.10.dev.rhaos3.11.git1eee681.el7
redhat/cri-o<0:1.14.12-15.dev.rhaos4.2.gita17905f.el8
0:1.14.12-15.dev.rhaos4.2.gita17905f.el8
redhat/cri-o<1.16.1
1.16.1
Kubernetes CRI-O<1.16.1
Fedoraproject Fedora
redhat OpenShift Container Platform=3.11
redhat OpenShift Container Platform=4.1
redhat OpenShift Container Platform=4.2

Remediation

Information

As of cri-o v1.15 you can set conmon_cgroup = "system.slice" in the crio.runtime section of /etc/crio/crio.conf. On OpenShift Container Platform 4.x that can be done by following the documentation here: https://access.redhat.com/documentation/en-us/openshift_container_platform/4.2/html/architecture/architecture-rhcos For OpenShift Container Platform 3.x you can edit /etc/crio/crio.conf directly on the worker node if using cri-o on that version. Cri-o is not the default container engine on that version, Docker is.

Event History

Nov 7, 2019
CVE Published
12:00 AM
Nov 25, 2019
CVE Published
via MITRE·10:31 AM
Data Sourced
via MITRE·10:31 AM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the vulnerability ID for this flaw in cri-o?

The vulnerability ID is CVE-2019-14891.

2

What is the severity of CVE-2019-14891?

The severity of CVE-2019-14891 is medium.

3

How does the flaw in cri-o affect container management processes?

The flaw can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition.

4

How can an attacker abuse the flaw in cri-o?

An attacker could abuse this flaw to cause an out-of-memory (OOM) condition and disrupt container management processes.

5

Which software versions are affected by CVE-2019-14891?

Cri-o versions up to and including 1.16.1 are affected.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203