Most recent entries from all

bdu:2024-02430

EUVD-2026-12730

fkie_cve-2022-4318

A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

GHSA-cm9x-c3rh-7rc4 — CRI-O vulnerable to /etc/passwd tampering resulting in Privilege Escalation

Affected: Go: github.com/cri-o/cri-o

### Impact It is possible to craft an environment variable with newlines to add entries to a container's /etc/passwd. It is possible to circumvent admission validation of username/UID by adding such an entry.

Note: because the pod author is in control of the container's /etc/passwd, this is not considered a new risk factor. However, this advisory is being opened for transparency and as a way of tracking fixes.

### Patches 1.26.0 will have the fix. More patches will be posted as they're available.

### Workarounds Additional security controls like SELinux should prevent any damage a container is able to do with root on the host. Using SELinux is recommended because this class of attack is already possible by manually editing the container's /etc/passwd

### References

gsd-2022-4318

msrc_CVE-2022-4318 — Cri-o: /etc/passwd tampering privesc

msrc_CVE-2022-4318

OESA-2024-1406 — cri-o security update

Affected: openEuler:22.03-LTS-SP1: cri-o

Open Container Initiative-based implementation of Kubernetes Container Runtime Interface. Security Fix(es): A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723) A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.(CVE-2022-4318) A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConc…

RHSA-2023:1033 — Red Hat Security Advisory: OpenShift Container Platform 4.12.6 packages and security update

cri-o: /etc/passwd tampering privesc

WID-SEC-W-2023-0600 — Red Hat OpenShift: Schwachstelle ermöglicht Manipulation von Dateien

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren.