Vulnerability Description
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Cri-O | < 1.19.7 |
| Fedoraproject | Fedora | 36 |
| Redhat | Openshift Container Platform | 3.11 |
| Redhat | Enterprise Linux | 7.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2085361Issue TrackingThird Party Advisory
- https://github.com/cri-o/cri-o/commit/f032cf649ecc7e0c46718bd9e7814bfb317cb544Patch
- https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6jExploitThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2085361Issue TrackingThird Party Advisory
- https://github.com/cri-o/cri-o/commit/f032cf649ecc7e0c46718bd9e7814bfb317cb544Patch
- https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6jExploitThird Party Advisory
FAQ
What is CVE-2022-1708?
CVE-2022-1708 is a vulnerability with a CVSS score of 7.5 (HIGH). A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output...
How severe is CVE-2022-1708?
CVE-2022-1708 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-1708?
Check the references section above for vendor advisories and patch information. Affected products include: Kubernetes Cri-O, Fedoraproject Fedora, Redhat Openshift Container Platform, Redhat Enterprise Linux.