https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 15:50:28 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-02537 bdu:2024-02537 https://cve.radiocsirt.org/vuln/bdu:2024-02537 https://cve.radiocsirt.org/vuln/euvd-2026-261493 EUVD-2026-261493 https://cve.radiocsirt.org/vuln/euvd-2026-261493 https://cve.radiocsirt.org/vuln/fkie_cve-2023-6476 <p>A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.</p> <p>A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-6476 https://cve.radiocsirt.org/vuln/ghsa-p4rx-7wvg-fwrc <p><strong>Affected:</strong> Go: github.com/cri-o/cri-o</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_ All versions of CRI-O running on cgroupv2 nodes. Unchecked access to an experimental annotation allows a container to be unconfined. Back in 2021, [support was added](https://github.com/cri-o/cri-o/pull/4479) to support an experimental annotation that allows a user to request special resources in cgroupv2. It was supposed to be gated by an experimental annotation: `io.kubernetes.cri-o.UnifiedCgroup`, which was supposed to be filtered from the [list of allowed annotations](https://github.com/cri-o/cri-o/blob/main/pkg/config/workloads.go#L103-L107) . However, there is a bug in this code which allows any user to specify this annotation, regardless of whether it&#39;s enabled on the node. The consequences of this are a pod can specify any amount of memory/cpu and get it, circumventing the kubernetes scheduler, and potentially be able to DOS a node. ### Patches _Has the problem been patched? What versions should users upgrade to?_ 1.29.1, 1.28.3, 1.27.3</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ use cgroupv1</p> <p>### References _Are there any links users can visit to find out more?_</p> <p><strong>Affected:</strong> Go: github.com/cri-o/cri-o</p> <p>### Impact _What kind of vulnerability is it? Who is impacted?_ All versions of CRI-O running on cgroupv2 nodes. Unchecked access to an experimental annotation allows a container to be unconfined. Back in 2021, [support was added](https://github.com/cri-o/cri-o/pull/4479) to support an experimental annotation that allows a user to request special resources in cgroupv2. It was supposed to be gated by an experimental annotation: `io.kubernetes.cri-o.UnifiedCgroup`, which was supposed to be filtered from the [list of allowed annotations](https://github.com/cri-o/cri-o/blob/main/pkg/config/workloads.go#L103-L107) . However, there is a bug in this code which allows any user to specify this annotation, regardless of whether it&#39;s enabled on the node. The consequences of this are a pod can specify any amount of memory/cpu and get it, circumventing the kubernetes scheduler, and potentially be able to DOS a node. ### Patches _Has the problem been patched? What versions should users upgrade to?_ 1.29.1, 1.28.3, 1.27.3</p> <p>### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ use cgroupv1</p> <p>### References _Are there any links users can visit to find out more?_</p> https://cve.radiocsirt.org/vuln/ghsa-p4rx-7wvg-fwrc https://cve.radiocsirt.org/vuln/gsd-2023-6476 gsd-2023-6476 https://cve.radiocsirt.org/vuln/gsd-2023-6476 https://cve.radiocsirt.org/vuln/msrc_cve-2023-6476 msrc_CVE-2023-6476 https://cve.radiocsirt.org/vuln/msrc_cve-2023-6476 https://cve.radiocsirt.org/vuln/rhsa-2024:0195 <p>cri-o: Pods are able to break out of resource confinement on cgroupv2</p> <p>cri-o: Pods are able to break out of resource confinement on cgroupv2</p> https://cve.radiocsirt.org/vuln/rhsa-2024:0195 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0137 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0137