A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.

🗓️ 04 Sep 2025 04:19:43Reported by MicrosoftType

CRI-O flaw allows a deployable pod to escape the container and execute as root on the cluster node.

Reporter	Title	Published	Views	Family All 54
ALT Linux	Security fix for the ALT Linux 10 package cri-o version 1.22.3-alt2	24 Mar 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package cri-o version 1.20.7-alt1	25 Mar 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM Netezza for Cloud Pak for Data is vulnerable to CVE-2022-0811	9 Aug 202206:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Netezza as a Service is vulnerable to CVE-2022-0811	4 Jul 202217:14	–	ibm
AlpineLinux	CVE-2022-0811	16 Mar 202214:03	–	alpinelinux
CBLMariner	CVE-2022-0811 affecting package cri-o for versions less than 1.22.3-1	12 Apr 202405:06	–	cbl_mariner
Circl	CVE-2022-0811	16 Mar 202217:20	–	circl
CISA	CRI-O Security Update for Kubernetes	18 Mar 202200:00	–	cisa
CNNVD	cri-o 代码注入漏洞	15 Mar 202200:00	–	cnnvd
Tenable Nessus	CRI-O package 1.19.x < 1.19.6 / 1.20.x < 1.20.7 / 1.21.x < 1.21.6 / 1.22.x < 1.22.3 / 1.23.x < 1.23.2 Arbitrary Code Execution (CVE-2022-0811)	21 Mar 202200:00	–	nessus