REDHAT-BUG-2375084: Medium severity cri-o cri-o vulnerability
When running a container using the securityContext.runAsUser setting to specify which user the container should use to be ran, if the requested user is not present in the '/etc/passwd' file in the container image, cri-o tries to create the new user information. For that cri-o reads the passwd file into the memory all at once using os.ReadFile() function, if the read passwd file is too big it can lead to increased memory consumption, eventually resulting in a Denial of Service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2375084?
The severity of REDHAT-BUG-2375084 is currently classified as medium due to potential security risks related to user management in containers.
How do I fix REDHAT-BUG-2375084?
To fix REDHAT-BUG-2375084, ensure that the user specified in the securityContext.runAsUser setting exists in the '/etc/passwd' file of the container image.
What causes REDHAT-BUG-2375084?
REDHAT-BUG-2375084 is caused by cri-o attempting to create user information when the specified user is not found in the '/etc/passwd' file.
Who is affected by REDHAT-BUG-2375084?
Developers and system administrators using container images with the cri-o runtime may be affected by REDHAT-BUG-2375084.
Is there a workaround for REDHAT-BUG-2375084?
A potential workaround for REDHAT-BUG-2375084 is to predefine users in the container’s image to match the required user ID before deployment.