88 matches found
Input validation
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace...
CVE-2022-0532
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace...
CVE-2022-0532
According to IBM’s security bulletin on CVE-2022-0532, Red Hat OpenShift on IBM Cloud is affected by a CRI-O vulnerability (CVE-2022-0532) caused by improper sysctls validation. A remote authenticated attacker could abuse hostIPC/hostNetwork to apply cluster-safe sysctls to the host, bypassing re...
CVE-2022-0532
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace...
CVE-2022-0532
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace...
CVE-2022-0532: Incorrect Permission Assignment for Critical Resource
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace...
CVE-2022-0532
An incorrect sysctls validation vulnerability was found in CRI-O. The sysctls from the list of "safe" sysctls specified for the cluster 0 will be applied to the host if an attacker can create a pod with a hostIPC and hostNetwork kernel namespace...
CVE-2021-38209
net/netfilter/nfconntrackstandalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NFSYSCTLCTMAX, NFSYSCTLCTEXPECTMAX, and NFSYSCTLCTBUCKETS sysctls...
CVE-2021-38209
net/netfilter/nfconntrackstandalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NFSYSCTLCTMAX, NFSYSCTLCTEXPECTMAX, and NFSYSCTLCTBUCKETS sysctls...
UBUNTU-CVE-2021-38209
net/netfilter/nfconntrackstandalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NFSYSCTLCTMAX, NFSYSCTLCTEXPECTMAX, and NFSYSCTLCTBUCKETS sysctls...
CVE-2021-38209
net/netfilter/nfconntrackstandalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NFSYSCTLCTMAX, NFSYSCTLCTEXPECTMAX, and NFSYSCTLCTBUCKETS sysctls...
CVE-2021-38209
net/netfilter/nfconntrackstandalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NFSYSCTLCTMAX, NFSYSCTLCTEXPECTMAX, and NFSYSCTLCTBUCKETS sysctls...
UVI-2021-1000164 netfilter: conntrack: Make global sysctls readonly in non-init netns
netfilter: conntrack: Make global sysctls readonly in non-init netns This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.35 by commit...
UVI-2021-1000129 netfilter: conntrack: Make global sysctls readonly in non-init netns
netfilter: conntrack: Make global sysctls readonly in non-init netns This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.11.19 by commit...
UVI-2021-1000091 netfilter: conntrack: Make global sysctls readonly in non-init netns
netfilter: conntrack: Make global sysctls readonly in non-init netns This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.2 by commit...
GSD-2021-1000129 netfilter: conntrack: Make global sysctls readonly in non-init netns
netfilter: conntrack: Make global sysctls readonly in non-init netns This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.11.19 by commit...
GSD-2021-1000091 netfilter: conntrack: Make global sysctls readonly in non-init netns
netfilter: conntrack: Make global sysctls readonly in non-init netns This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.2 by commit...
GSD-2021-1000164 netfilter: conntrack: Make global sysctls readonly in non-init netns
netfilter: conntrack: Make global sysctls readonly in non-init netns This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.35 by commit...
Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements
Impact An attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service. In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host via ipv6.disable=1 on the kernel cmdline, it wi...
PT-2021-4231
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.12.2 Description The issue is related to the NF SYSCTL CT MAX, NF SYSCTL CT EXPECT MAX, and NF SYSCTL CT BUCKETS sysctls in the net/netfilter/nf conntrack standalone.c component of the Linux kernel. It allows...