CVE-2023-0229: Input Validation
A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.
Other sources
In github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, a bug was found that can allows low privileged users to set the seccomp profile for pods they control to "unconfined". By default the seccomp profile used in the restricted-v2 Security Context Contstraint (SCC) is "runtime/default", thus this bug allows users disable seccomp for pods they can create and/or modify.
Seccomp is one of many security layers used in OpenShift, including SELinux, dropping of capabilities and running as non-root, so on its own disabling of seccomp does not allow a direct path to privilege escalation. However, it is possible that exploit of this bug could be used in combination with another vulnerability, e.g. a potential kernel privilege escalation flaw, to allow a user to escape a container.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-0229?
CVE-2023-0229 is a vulnerability found in github.com/openshift/apiserver-library-go used in OpenShift 4.12 and 4.11 that allows low-privileged users to set the seccomp profile for pods they control to "unconfined."
Which software versions are affected by CVE-2023-0229?
OpenShift 4.12 and 4.11 are affected by CVE-2023-0229.
How severe is CVE-2023-0229?
CVE-2023-0229 has a severity rating of 6.3, which is considered medium.
How can low-privileged users exploit CVE-2023-0229?
Low-privileged users can exploit CVE-2023-0229 by setting the seccomp profile for pods they control to "unconfined."
Where can I find more information about CVE-2023-0229?
You can find more information about CVE-2023-0229 in the following references: https://www.cve.org/CVERecord?id=CVE-2023-0229, https://nvd.nist.gov/vuln/detail/CVE-2023-0229, https://bugzilla.redhat.com/show_bug.cgi?id=2160349, https://access.redhat.com/errata/RHBA-2023:1037