https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 00:55:22 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-01319 bdu:2022-01319 https://cve.radiocsirt.org/vuln/bdu:2022-01319 https://cve.radiocsirt.org/vuln/euvd-2026-11244 EUVD-2026-11244 https://cve.radiocsirt.org/vuln/euvd-2026-11244 https://cve.radiocsirt.org/vuln/fkie_cve-2022-0811 <p>A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.</p> <p>A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-0811 https://cve.radiocsirt.org/vuln/ghsa-6x2m-w449-qwx7 <p><strong>Affected:</strong> Go: github.com/cri-o/cri-o</p> <p>### Impact A flaw introduced in CRI-O version 1.19 which an attacker can use to bypass the safeguards and set arbitrary kernel parameters on the host. As a result, anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime can abuse the `kernel.core_pattern` kernel parameter to achieve container escape and arbitrary code execution as root on any node in the cluster.</p> <p>### Patches The patches will be present in 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2, 1.24.0</p> <p>### Workarounds - Users can set manage_ns_lifecycle to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don&#39;t have this option. - An admission webhook could be created to deny pods that specify a `+` in the sysctl value of a pod. - A [PodSecurityPolicy](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy) [deprecated] could be created, specifying all sysctls as forbidden like so: ``` apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: sysctl-psp spec: forbiddenSysctls: - &#34;*&#34; ``` However, this option will not work if any sysctls are required by any pods in the cluster.</p> <p>### Credits Credit for finding this vulnerability goes to John Walker and Manoj Ahuje of Crowdstrike. The CRI-O community deeply thanks them for the report.</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in…</p> <p><strong>Affected:</strong> Go: github.com/cri-o/cri-o</p> <p>### Impact A flaw introduced in CRI-O version 1.19 which an attacker can use to bypass the safeguards and set arbitrary kernel parameters on the host. As a result, anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime can abuse the `kernel.core_pattern` kernel parameter to achieve container escape and arbitrary code execution as root on any node in the cluster.</p> <p>### Patches The patches will be present in 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2, 1.24.0</p> <p>### Workarounds - Users can set manage_ns_lifecycle to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don&#39;t have this option. - An admission webhook could be created to deny pods that specify a `+` in the sysctl value of a pod. - A [PodSecurityPolicy](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy) [deprecated] could be created, specifying all sysctls as forbidden like so: ``` apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: sysctl-psp spec: forbiddenSysctls: - &#34;*&#34; ``` However, this option will not work if any sysctls are required by any pods in the cluster.</p> <p>### Credits Credit for finding this vulnerability goes to John Walker and Manoj Ahuje of Crowdstrike. The CRI-O community deeply thanks them for the report.</p> <p>### For more information If you have any questions or comments about this advisory: * Open an issue in…</p> https://cve.radiocsirt.org/vuln/ghsa-6x2m-w449-qwx7 https://cve.radiocsirt.org/vuln/gsd-2022-0811 gsd-2022-0811 https://cve.radiocsirt.org/vuln/gsd-2022-0811 https://cve.radiocsirt.org/vuln/msrc_cve-2022-0811 msrc_CVE-2022-0811 https://cve.radiocsirt.org/vuln/msrc_cve-2022-0811 https://cve.radiocsirt.org/vuln/rhsa-2022:0810 <p>CRI-O: Arbitrary code execution in cri-o via abusing “kernel.core_pattern” kernel parameter</p> <p>CRI-O: Arbitrary code execution in cri-o via abusing “kernel.core_pattern” kernel parameter</p> https://cve.radiocsirt.org/vuln/rhsa-2022:0810