CVE-2022-0811
Published: 16 March 2022
Summary
CVE-2022-0811 is a high-severity Code Injection (CWE-94) vulnerability in Kubernetes Cri-O. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A flaw was found in CRI-O in the way it set kernel options for a pod. This vulnerability, identified as CVE-2022-0811 and assigned CWE-94, affects Kubernetes clusters that use the CRI-O runtime and carries a CVSS 3.1 score of 8.8.
Anyone with rights to deploy a pod on an affected cluster can exploit the issue to achieve a container escape and arbitrary code execution as root on the cluster node where the malicious pod was deployed.
References to the issue, including Red Hat Bugzilla entry 2059475 and the CRI-O GitHub security advisory GHSA-6x2m-w449-qwx7, point to further details on available patches and mitigations. The associated EPSS score shows a current value of 0.2277 against a peak of 0.2485.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1349
Vulnerability details
A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape…
more
and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.