Read the docs
TI-2022-00719 Aliases CVE-2022-0811GHSA-6x2m-w449-qwx7

Code injection in CRI-O

Priority MEDIUM 56CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.

Why it matters now

EPSS 0.19046 97th percentileScored 2026-11-07
Fix Fixed github.com/cri-o/cri-o (Go): 1.19.6, 1.20.7, 1.21.6 +2Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—CRI-Ocri-o 1.24.0, cri-o 1.23.2, cri-o 1.22.3, cri-o 1.21.6, cri-o 1.20.7, cri-o 1.19.6—No fix listedCNA
—github.com/cri-o/cri-o (Go)1.19.0 to before 1.19.61.19.6Patch availableGHSA-6x2m-w449-qwx7
—github.com/cri-o/cri-o (Go)1.20.0 to before 1.20.71.20.7Patch availableGHSA-6x2m-w449-qwx7
—github.com/cri-o/cri-o (Go)1.21.0 to before 1.21.61.21.6Patch availableGHSA-6x2m-w449-qwx7
—github.com/cri-o/cri-o (Go)1.22.0 to before 1.22.31.22.3Patch availableGHSA-6x2m-w449-qwx7
—github.com/cri-o/cri-o (Go)1.23.0 to before 1.23.21.23.2Patch availableGHSA-6x2m-w449-qwx7
  • CRI-O Vendor— Affected cri-o 1.24.0, cri-o 1.23.2, cri-o 1.22.3, cri-o 1.21.6, cri-o 1.20.7, cri-o 1.19.6 Fixed in — No fix listed CNA
  • github.com/cri-o/cri-o (Go) Vendor— Affected 1.19.0 to before 1.19.6 Fixed in 1.19.6 Patch available GHSA-6x2m-w449-qwx7
  • github.com/cri-o/cri-o (Go) Vendor— Affected 1.20.0 to before 1.20.7 Fixed in 1.20.7 Patch available GHSA-6x2m-w449-qwx7
  • github.com/cri-o/cri-o (Go) Vendor— Affected 1.21.0 to before 1.21.6 Fixed in 1.21.6 Patch available GHSA-6x2m-w449-qwx7
  • github.com/cri-o/cri-o (Go) Vendor— Affected 1.22.0 to before 1.22.3 Fixed in 1.22.3 Patch available GHSA-6x2m-w449-qwx7
  • github.com/cri-o/cri-o (Go) Vendor— Affected 1.23.0 to before 1.23.2 Fixed in 1.23.2 Patch available GHSA-6x2m-w449-qwx7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:*1.19.0 to before 1.19.6; 1.20.0 to before 1.20.7; 1.21.0 to before 1.21.6; 1.22.0 to before 1.22.3; 1.23.0 to before 1.23.2VulnerableKubernetes
  • cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:* Versions 1.19.0 to before 1.19.6; 1.20.0 to before 1.20.7; 1.21.0 to before 1.21.6; 1.22.0 to before 1.22.3; 1.23.0 to before 1.23.2 Vulnerable ·Kubernetes

Remediation

  • Fix · GHSA-6x2m-w449-qwx7 github.com/cri-o/cri-o (Go) Fixed in 1.19.6 Advisory →
  • Fix · GHSA-6x2m-w449-qwx7 github.com/cri-o/cri-o (Go) Fixed in 1.20.7 Advisory →
  • Fix · GHSA-6x2m-w449-qwx7 github.com/cri-o/cri-o (Go) Fixed in 1.21.6 Advisory →
  • Fix · GHSA-6x2m-w449-qwx7 github.com/cri-o/cri-o (Go) Fixed in 1.22.3 Advisory →
  • Fix · GHSA-6x2m-w449-qwx7 github.com/cri-o/cri-o (Go) Fixed in 1.23.2 Advisory →

Red Hat 5 advisories

  • RHSA-2022:0866 Released 2022-03-23 · Red Hat rating Important
    OpenShift Container Platform 4.6.56 packages and security update
    • Red Hat OpenShift Container Platform 4.6 cri-o-1.19.5-3.rhaos4.6.git91f8458.el7, cri-o-1.19.5-3.rhaos4.6.git91f8458.el8
  • RHSA-2022:0871 Released 2022-03-22 · Red Hat rating Important
    OpenShift Container Platform 4.8.35 security update
    • Red Hat OpenShift Container Platform 4.8 cri-o-1.21.5-3.rhaos4.8.gitaf64931.el7, cri-o-1.21.5-3.rhaos4.8.gitaf64931.el8, jenkins-2-plugins-4.8.1646993358-1.el8
  • RHSA-2022:0870 Released 2022-03-22 · Red Hat rating Important
    OpenShift Container Platform 4.7.45 packages and security update
    • Red Hat OpenShift Container Platform 4.7 cri-o-1.20.6-11.rhaos4.7.git76ea3d0.el7, cri-o-1.20.6-11.rhaos4.7.git76ea3d0.el8
Show 2 more Red Hat advisories
  • RHSA-2022:0860 Released 2022-03-21 · Red Hat rating Important
    OpenShift Container Platform 4.9.25 security update
    • Red Hat OpenShift Container Platform 4.9 cri-o-1.22.2-3.rhaos4.9.gitb030be8.el7, cri-o-1.22.2-3.rhaos4.9.gitb030be8.el8
  • RHSA-2022:0810 Released 2022-03-15 · Red Hat rating Important
    OpenShift Container Platform 4.10.4 security update
    • Red Hat OpenShift Container Platform 4.10 cri-o-1.23.1-12.rhaos4.10.git1607c6e.el7, cri-o-1.23.1-12.rhaos4.10.git1607c6e.el8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4.10Fixed RHSA-2022:0810
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2022:0866
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2022:0870
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2022:0871
Red Hat OpenShift Container Platform 4.9Fixed RHSA-2022:0860
Not affected: 6 products
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.10
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat OpenShift Container Platform 4.7
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat OpenShift Container Platform 4.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0811
  2. 2026-10-03 Alias added: GHSA-6x2m-w449-qwx7

References

Advisory 3

Other 4

  • TI-2022-02765 Improper access control in cri-o CVSS 3.1HIGH 7.1
  • TI-2018-15874 Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error… CVSS 3.0HIGH 8.8
  • TI-2024-04785 Cri-o: malicious container can create symlink on host CVSS 3.1HIGH 8.1
  • TI-2022-01574 Uncontrolled resource consumption in CRI-O CVSS 3.1HIGH 7.5
  • TI-2022-03955 Cri-o: /etc/passwd tampering privesc CVSS 3.1HIGH 7.8
  • TI-2022-10633 Incorrect default permissions in cri-o CVSS 3.1MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences