Skip to content
Fencer Intel
high 8.8

CVE-2022-0811 in the critical feed json

Code Injection in CRI-O

published 4y ago modified 4mo ago also GHSA-6x2m-w449-qwx7 , GO-2022-0354 , EUVD-2022-1349

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
19.0%
EPSS 19.0% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.

Patch / fix

  • go github.com/cri-o/cri-o 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2
  • kubernetes cri-o 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2
  • cri-o openshift 4.8 1.21.5-3.rhaos4.8.gitaf64931.el7
  • cri-o openshift 4.8 1.21.5-3.rhaos4.8.gitaf64931.el8
  • jenkins-2-plugins openshift 4.8 4.8.1646993358-1.el8
  • cri-o openshift 4.6 1.19.5-3.rhaos4.6.git91f8458.el7
  • cri-o openshift 4.6 1.19.5-3.rhaos4.6.git91f8458.el8
  • cri-o openshift 4.7 1.20.6-11.rhaos4.7.git76ea3d0.el7
  • cri-o openshift 4.7 1.20.6-11.rhaos4.7.git76ea3d0.el8
  • cri-o openshift 4.9 1.22.2-3.rhaos4.9.gitb030be8.el7

red hat advisories RHSA-2022:0871RHSA-2022:0866RHSA-2022:0870RHSA-2022:0860RHSA-2022:0810

  • cri-o Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.23.2-r0

alpine advisories ALPINE-CVE-2022-0811

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cri-o CBL-Mariner 2.0 1.22.3-1

azure linux advisories AZL-37070

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2022-0811 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0811 updated cvss 8.8

CRI-O: Arbitrary code execution in cri-o via abusing “kernel.core_pattern” kernel parameter

  • Red Hat OpenShift Container Platform 4.6 cri-o 1.19.5-3.rhaos4.6.git91f8458.el7, cri-o 1.19.5-3.rhaos4.6.git91f8458.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:0866
  • Red Hat OpenShift Container Platform 4.7 cri-o 1.20.6-11.rhaos4.7.git76ea3d0.el7, cri-o 1.20.6-11.rhaos4.7.git76ea3d0.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:0870
  • Red Hat OpenShift Container Platform 4.8 cri-o 1.21.5-3.rhaos4.8.gitaf64931.el7, cri-o 1.21.5-3.rhaos4.8.gitaf64931.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:0871
  • Red Hat OpenShift Container Platform 4.9 cri-o 1.22.2-3.rhaos4.9.gitb030be8.el7, cri-o 1.22.2-3.rhaos4.9.gitb030be8.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:0860
  • Red Hat OpenShift Container Platform 4.10 cri-o 1.23.1-12.rhaos4.10.git1607c6e.el7, cri-o 1.23.1-12.rhaos4.10.git1607c6e.el8
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2022:0810
  • Red Hat OpenShift Container Platform 3.11 cri-o Red Hat OpenShift Container Platform 4.6 openshift 4.6.0-202203110946.p0.g6175753.assembly.stream.el7, openshift 4.6.0-202203110946.p0.g6175753.assembly.stream.el8, openshift-kuryr 4.6.0-202202251050.p0.g74cd766.assembly.stream.el8, openshift-ansible 4.6.0-202202251050.p0.g87e9f0c.assembly.stream.el7, openshift-clients 4.6.0-202203011423.p0.gb153f08.assembly.stream.el7, openshift-clients 4.6.0-202203011423.p0.gb153f08.assembly.stream.el8, +10 more Red Hat OpenShift Container Platform 4.7 openshift 4.7.0-202203091647.p0.g0d60930.assembly.stream.el7, openshift 4.7.0-202203091647.p0.g0d60930.assembly.stream.el8, openshift-clients 4.7.0-202202231953.p0.gc4ebc7a.assembly.stream.el7, openshift-clients 4.7.0-202202231953.p0.gc4ebc7a.assembly.stream.el8, openshift-hyperkube 4.7.0-202203091647.p0.g0d60930.assembly.stream.el7, openshift-hyperkube 4.7.0-202203091647.p0.g0d60930.assembly.stream.el8, +2 more Red Hat OpenShift Container Platform 4.8 jenkins-2-plugins 4.8.1646993358-1.el8, openshift 4.8.0-202203100757.p0.gee73ea2.assembly.stream.el7, openshift 4.8.0-202203100757.p0.gee73ea2.assembly.stream.el8, openshift-ansible 4.8.0-202203100145.p0.gfccb320.assembly.stream.el7, openshift-hyperkube 4.8.0-202203100757.p0.gee73ea2.assembly.stream.el7, openshift-hyperkube 4.8.0-202203100757.p0.gee73ea2.assembly.stream.el8, +1 more Red Hat OpenShift Container Platform 4.9 openshift-clients 4.9.0-202203112019.p0.g1791fd4.assembly.stream.el7, openshift-clients 4.9.0-202203112019.p0.g1791fd4.assembly.stream.el8, openshift-clients-redistributable 4.9.0-202203112019.p0.g1791fd4.assembly.stream.el7, openshift-clients-redistributable 4.9.0-202203112019.p0.g1791fd4.assembly.stream.el8 Red Hat OpenShift Container Platform 4.10 haproxy 2.2.19-2.el8
    not affected: vulnerable code not present “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

19.05% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/cri-o/cri-o
>=1.19.0, <1.19.6
>=1.20.0, <1.20.7
>=1.21.0, <1.21.6
>=1.22.0, <1.22.3
>=1.23.0, <1.23.2
1.19.6
1.20.7
1.21.6
1.22.3
1.23.2

Affected products

  • n/a CRI-O

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.