CVE-2022-3466: Cri-o: security regression of cve-2022-27652
The following cri-o packages as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31 and 4.11.6 included an incorrect version of cri-o that was missing the fix for CVE-2022-27652:
- cri-o-1.22.5-10.rhaos4.9.gitd14fede.el8 via RHBA-2022:6316 (https://access.redhat.com/errata/RHBA-2022:6316) - cri-o-1.23.3-16.rhaos4.10.gitd7c9b35.el8 via RHBA-2022:6257 (https://access.redhat.com/errata/RHBA-2022:6257) - cri-o-1.24.2-7.rhaos4.11.gitca400e0.el8 via RHBA-2022:6658 (https://access.redhat.com/errata/RHBA-2022:6658)
The regressed CVE-2022-27652 was previously corrected in Red Hat OpenShift Container Platform 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600, respectively.
CVE-2022-3466 was assigned to this security regression and it is specific to the cri-o packages produced by Red Hat. The original issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details about the original issue, see:
https://access.redhat.com/security/cve/CVE-2022-27652 https://bugzilla.redhat.com/showbug.cgi?id=CVE-2022-27652
Other sources
The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cri-oto a version that resolves this vulnerability.Fixed in 0:1.25.1-5.rhaos4.12.git6005903.el8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch RHBA-2022:5433 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch RHSA-2022:1600 - Compensating control
Restrict access to binaries and programs that have inheritable file capabilities to trusted administrators and hosts (use filesystem permissions, host-level access controls, and network restrictions) until the cri-o package is upgraded to a fixed version.
Event History
Frequently Asked Questions
What is CVE-2022-3466?
CVE-2022-3466 is a vulnerability in the cri-o component of Red Hat OpenShift Container Platform.
How severe is CVE-2022-3466?
CVE-2022-3466 has a severity rating of medium with a CVSS score of 5.3.
Which versions of Red Hat OpenShift Container Platform are affected by CVE-2022-3466?
Red Hat OpenShift Container Platform versions 4.9.48, 4.10.31, and 4.11.6 are affected.
What is the affected component in Red Hat OpenShift Container Platform?
The cri-o component in Red Hat OpenShift Container Platform is affected.
How can I fix CVE-2022-3466 vulnerability?
To fix the CVE-2022-3466 vulnerability, update cri-o to version 1.25.1-5.rhaos4.12.git6005903.el8 or later.