CVE-2022-0532

Name of the Vulnerable Software and Affected Versions CRI-O versions 1.18 and earlier

Description An incorrect sysctls validation issue was found, allowing an attacker to apply sysctls from the list of "safe" sysctls specified for the cluster to the host if they can create a pod with a hostIPC and hostNetwork kernel namespace.

Recommendations For CRI-O versions 1.18 and earlier, as a temporary workaround, consider restricting the creation of pods with hostIPC and hostNetwork kernel namespace to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.