CVE-2023-6476 Cri-o: pods are able to break out of resource confinement on cgroupv2

2024-01-0921:32:03

CWE-770

redhat

www.cve.org

cve-2023-6476

cri-o

resource confinement

cgroupv2

denial of service

kubernetes

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

24.2%

JSON

A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4.13",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "cri-o",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.13::el9",
      "cpe:/a:redhat:openshift:4.13::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4.14",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "cri-o",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:1.27.2-7.rhaos4.14.git1cc7a64.el8",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift:4.14::el8",
      "cpe:/a:redhat:openshift:4.14::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 3.11",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "cri-o",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:openshift:3.11"
    ]
  }
]