REDHAT-BUG-2520330: Medium severity cri-o cri-o vulnerability
A security issue was found in CRI-O’s bindmountprefix handling where it is configured with non-empty bindmountprefix, a CRI hostPath containing an intermediate absolute symlink may cause the eventual bind mount source to resolve outside the inteneded prefixed root. bindmountprefix is used in deployments where CRI-O itself runs in a container and the real host root is mounted under a prefix such as /host. In this If kubernetes/CRI requests CRI-O to mount /var/lib/example it will mount /host/var/lib/example. The exploitation requires that the resulting path contains an intermediate absolute symlink.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using CRI-O with a non-empty bind_mount_prefix are exposed. This configuration is used when CRI-O runs in a container and the real host root is mounted beneath a prefix such as /host.
What is required for exploitation?
Kubernetes or CRI must request a hostPath mount whose resulting prefixed source path contains an intermediate absolute symlink. That symlink can cause the bind mount source to resolve outside the intended prefixed root.