CVE-2022-0811

HIGH

Kubernetes Cri-o < 1.19.6 - Code Injection

Title source: rule

Description

A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.

Exploits (1)

nomisec WORKING POC 8 stars

by spiarh · poc

https://github.com/spiarh/webhook-cve-2022-0811

View Code ZIP pw:eip

References (2)

[Issue Tracking, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=2059475

[Third Party Advisory] https://github.com/cri-o/cri-o/security/advisories/GHSA-6x2m-w449-qwx7

Scores

CVSS v3 8.8

EPSS 0.2177

EPSS Percentile 95.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-94

Status published

Products (2)

cri-o/cri-o 1.19.0 - 1.19.6Go

kubernetes/cri-o 1.19.0 - 1.19.6

Published Mar 16, 2022

Tracked Since Feb 18, 2026