Skip to content
Fencer Vulns
medium 4.2

CVE-2022-0532 json

Incorrect Permission Assignment for Critical Resource in CRI-O

published 2022-02-09 4 y ago modified 2026-06-17 4 mo ago also GHSA-jqmc-79gx-7g8p , GO-2022-0608 , EUVD-2022-1081

cvss
4.2
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Patch / fix

  • go github.com/cri-o/cri-o 1.23.1
  • cri-o openshift 4.10 1.23.0-92.rhaos4.10.gitdaab4d1.el7
  • cri-o openshift 4.10 1.23.1-9.rhaos4.10.gitbdffb9a.el8
  • jenkins openshift 4.10 2.319.2.1643288987-1.el8
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
  • openshift openshift 4.10 4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
  • coreos-installer openshift 4.10 0.12.0-1.rhaos4.10.el8
  • jenkins-2-plugins openshift 4.10 4.10.1643404185-1.el8
  • openshift-clients openshift 4.10 4.10.0-202202160023.p0.gf93da17.assembly.stream.el7

red hat advisories RHSA-2022:0055RHSA-2022:0866RHSA-2022:0870RHBA-2022:0794RHBA-2022:0793

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0532 updated cvss 4.2

cri-o: pod with access to 'hostIPC' and 'hostNetwork' kernel namespace allows sysctl from the list of safe sysctls to be applied to the host

  • Red Hat OpenShift Container Platform 3.11 cri-o
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4.6 cri-o 1.19.5-3.rhaos4.6.git91f8458.el7, cri-o 1.19.5-3.rhaos4.6.git91f8458.el8
    fixed: vendor fix RHSA-2022:0866
  • Red Hat OpenShift Container Platform 4.7 cri-o 1.20.6-11.rhaos4.7.git76ea3d0.el7, cri-o 1.20.6-11.rhaos4.7.git76ea3d0.el8
    fixed: vendor fix RHSA-2022:0870
  • Red Hat OpenShift Container Platform 4.8 cri-o 1.21.5-2.rhaos4.8.gitaf64931.el7, cri-o 1.21.5-2.rhaos4.8.gitaf64931.el8
    fixed: vendor fix RHBA-2022:0793
  • Red Hat OpenShift Container Platform 4.9 cri-o 1.22.2-2.rhaos4.9.gitb030be8.el7, cri-o 1.22.2-2.rhaos4.9.gitb030be8.el8
    fixed: vendor fix RHBA-2022:0794
  • Red Hat OpenShift Container Platform 4.10 cri-o 1.23.1-9.rhaos4.10.gitbdffb9a.el8, cri-o 1.23.0-92.rhaos4.10.gitdaab4d1.el7
    fixed: vendor fix RHSA-2022:0055
  • Red Hat OpenShift Container Platform 4.6 openshift 4.6.0-202203110946.p0.g6175753.assembly.stream.el7, openshift 4.6.0-202203110946.p0.g6175753.assembly.stream.el8, openshift-kuryr 4.6.0-202202251050.p0.g74cd766.assembly.stream.el8, openshift-ansible 4.6.0-202202251050.p0.g87e9f0c.assembly.stream.el7, openshift-clients 4.6.0-202203011423.p0.gb153f08.assembly.stream.el7, openshift-clients 4.6.0-202203011423.p0.gb153f08.assembly.stream.el8, +10 more Red Hat OpenShift Container Platform 4.7 openshift 4.7.0-202203091647.p0.g0d60930.assembly.stream.el7, openshift 4.7.0-202203091647.p0.g0d60930.assembly.stream.el8, openshift-clients 4.7.0-202202231953.p0.gc4ebc7a.assembly.stream.el7, openshift-clients 4.7.0-202202231953.p0.gc4ebc7a.assembly.stream.el8, openshift-hyperkube 4.7.0-202203091647.p0.g0d60930.assembly.stream.el7, openshift-hyperkube 4.7.0-202203091647.p0.g0d60930.assembly.stream.el8, +2 more Red Hat OpenShift Container Platform 4.8 ovn2.13 20.12.0-195.el8fdp, ovn2.13-host 20.12.0-195.el8fdp, ovn2.13-vtep 20.12.0-195.el8fdp, ovn2.13-central 20.12.0-195.el8fdp, openshift 4.8.0-202203040839.p0.g8a3bf4a.assembly.stream.el7, openshift 4.8.0-202203040839.p0.g8a3bf4a.assembly.stream.el8, +2 more Red Hat OpenShift Container Platform 4.9 openshift 4.9.0-202203012249.p0.g5c84e52.assembly.stream.el7, openshift 4.9.0-202203012249.p0.g5c84e52.assembly.stream.el8, openshift-ansible 4.9.0-202203081819.p0.ge266b64.assembly.stream.el7, openshift-hyperkube 4.9.0-202203012249.p0.g5c84e52.assembly.stream.el7, openshift-hyperkube 4.9.0-202203012249.p0.g5c84e52.assembly.stream.el8, openshift-ansible-test 4.9.0-202203081819.p0.ge266b64.assembly.stream.el7 Red Hat OpenShift Container Platform 4.10 buildah 1.19.7-1.el8, haproxy 2.2.19-1.el8, cri-tools 1.23.0-1.el7, cri-tools 1.23.0-1.el8, python-pbr 5.5.1-1.el8ost, buildah-tests 1.19.7-1.el8, +163 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
NVD 2.0 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P
GitHub 3.1 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

Affected packages

ecosystem package affected fixed in
go github.com/cri-o/cri-o
<1.23.1
1.23.1

Affected products

  • n/a cri-o

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.