In CRI-O, the runtime for managing isolated containers, a critical vulnerability (CVE-2022-0811) has been discovered, allowing the isolation to be bypassed and the execution of arbitrary code on the host system. If CRI-O is used instead of containerd and Docker to run containers under the Kubernetes platform, an attacker can gain control over any node in the Kubernetes cluster. To execute the attack, only permissions to run their own container in the Kubernetes cluster are required.
The vulnerability is caused by the ability to modify the kernel sysctl parameter 'kernel.core_pattern' ('/proc/sys/kernel/core_pattern'), which was not blocked despite it not being one of the safe parameters that can be modified only in the current container's namespace. Using this parameter, a user from the container can change the Linux kernel’s behavior regarding core file handling on the host environment and execute arbitrary commands with root privileges on the host by specifying a handler like '|/bin/sh -c ‘commands’.
Il problema si presenta a partire dalla versione CRI-O 1.19.0 ed è stato risolto negli aggiornamenti 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2 e 1.24.0. Nei pacchetti distribuiti, il problema è presente nei prodotti Red Hat OpenShift Container Platform e openSUSE/SUSE, i cui repository contengono il pacchetto cri-o.
Fonte: opennet.ru
