CVE-2022-0532: Medium severity cri-o vulnerability
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
Other sources
An incorrect sysctls validation vulnerability was found in CRI-O. The sysctls from the list of "safe" sysctls specified for the cluster [0] will be applied to the host if an attacker can create a pod with a hostIPC and hostNetwork kernel namespace.
It was found that if a user can create a pod with a hostIPC and hostNetwork kernel namespace and is able to specify a sysctl from the list of "safe" sysctls specified for the cluster (by default, these are specified here <https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls>), then the sysctls will be applied to the host.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-0532?
CVE-2022-0532 is an incorrect sysctls validation vulnerability found in CRI-O.
How does CVE-2022-0532 impact CRI-O?
CVE-2022-0532 allows an attacker to apply sysctls from the list of "safe" sysctls to the host if they can create a pod with a hostIPC and hostNetwork kernel namespace.
What is the severity level of CVE-2022-0532?
CVE-2022-0532 has a severity level of medium.
Which versions of CRI-O are affected by CVE-2022-0532?
CRI-O versions 1.18 and earlier are affected by CVE-2022-0532.
How can I fix CVE-2022-0532 in CRI-O?
To fix CVE-2022-0532, upgrade to CRI-O version 1.23.1 or later.