A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/cri-o/cri-o(Go) | 1.19.0 | 1.19.6 | N/A |
| github.com/cri-o/cri-o(Go) | 1.20.0 | 1.20.7 | N/A |
| github.com/cri-o/cri-o(Go) | 1.21.0 | 1.21.6 | N/A |
| github.com/cri-o/cri-o(Go) | 1.22.0 | 1.22.3 | N/A |
| github.com/cri-o/cri-o(Go) | 1.23.0 | 1.23.2 | N/A |
CVSS Metrics
