CVE-2019-14891: Medium severity cri-o vulnerability
A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.
Other sources
Cri-o pods didn't provide sufficient isolation between the workload and infra containers such that when a workload consumed a large amount of memory, the kernel accidently killed the infra container's conmon process. An attacker would use the flaw to get host network access on an Kubernetes worker node.
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this flaw in cri-o?
The vulnerability ID is CVE-2019-14891.
What is the severity of CVE-2019-14891?
The severity of CVE-2019-14891 is medium.
How does the flaw in cri-o affect container management processes?
The flaw can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition.
How can an attacker abuse the flaw in cri-o?
An attacker could abuse this flaw to cause an out-of-memory (OOM) condition and disrupt container management processes.
Which software versions are affected by CVE-2019-14891?
Cri-o versions up to and including 1.16.1 are affected.