CVE-2022-4318: Cri-o: /etc/passwd tampering privesc
Impact It is possible to craft an environment variable with newlines to add entries to a container's /etc/passwd. It is possible to circumvent admission validation of username/UID by adding such an entry.
Note: because the pod author is in control of the container's /etc/passwd, this is not considered a new risk factor. However, this advisory is being opened for transparency and as a way of tracking fixes.
Patches 1.26.0 will have the fix. More patches will be posted as they're available.
Workarounds Additional security controls like SELinux should prevent any damage a container is able to do with root on the host. Using SELinux is recommended because this class of attack is already possible by manually editing the container's /etc/passwd
References
Other sources
A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
It is possible to craft an environment variable with newlines to add entries to /etc/passwd. Using the default SCC prevents the privesc. A malicious user could use a non-default SCC (anyuid, for example) that allows the process to become root on the host.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-4318?
CVE-2022-4318 is a vulnerability found in cri-o that allows the addition of arbitrary lines into /etc/passwd.
What is the impact of CVE-2022-4318?
The impact of CVE-2022-4318 is the ability to add entries to a container's /etc/passwd by crafting an environment variable with newlines.
How can the admission validation of username/UID be circumvented in CVE-2022-4318?
Admission validation of username/UID can be circumvented in CVE-2022-4318 by adding an entry with newlines to the container's /etc/passwd.
Which software versions are affected by CVE-2022-4318?
The software versions affected by CVE-2022-4318 include cri-o 1.26.0, Kubernetes Cri-o, Redhat Openshift Container Platform, Redhat Enterprise Linux, Fedoraproject Extra Packages For Enterprise Linux, and Fedoraproject Fedora.
What is the severity of CVE-2022-4318?
CVE-2022-4318 has a severity rating of 7.8 (high).