REDHAT-BUG-2500846: High severity CRI-O vulnerability
The fix for CVE-2022-4318 in CRI-O is incorrect and has been bypassable since it was introduced on December 14, 2022. The check in server/containercreate.go uses a Go raw string literal (\n) instead of an interpreted string literal ("\n"), causing it to search for the literal two-character sequence backslash-n (0x5c 0x6e) rather than an actual newline character (0x0a).
An attacker who can set environment variables on a container (via the CRI CreateContainer request) can supply a real newline character in the HOME environment variable, bypassing the check entirely. The unsanitized value is then passed to utils.GeneratePasswd, which uses fmt.Sprintf to construct the container's /etc/passwd content, allowing arbitrary line injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2022-4318 - Compensating control
Block or restrict the ability for untrusted parties to influence container environment variables via the CRI CreateContainer request (e.g., enforce that only trusted callers can set environment variables on containers).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2500846?
The severity of REDHAT-BUG-2500846 is classified as high, rated at 7.
What vulnerability does REDHAT-BUG-2500846 address?
REDHAT-BUG-2500846 addresses an incorrect fix for CVE-2022-4318 in CRI-O.
How does the vulnerability REDHAT-BUG-2500846 manifest?
The vulnerability manifests due to the use of a Go raw string literal in the check within server/container_create.go.
How do I fix REDHAT-BUG-2500846?
To fix REDHAT-BUG-2500846, it is essential to ensure the correct string literal is used in the affected code.
When was REDHAT-BUG-2500846 published?
REDHAT-BUG-2500846 was published on July 15, 2026.