Skip to content
Fencer Vulns
high 7.8

CVE-2022-4318 json

Cri-o: /etc/passwd tampering privesc

published 2022-12-29 3 y ago modified 2026-06-17 4 mo ago also GHSA-cm9x-c3rh-7rc4 , GO-2022-1206 , EUVD-2022-7601

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Patch / fix

  • go github.com/cri-o/cri-o 1.26.0
  • Red Hat Red Hat OpenShift Container Platform 4.11 0:1.24.4-10.rhaos4.11.git1ed5ac5.el8
  • Red Hat Red Hat OpenShift Container Platform 4.12 0:1.25.2-9.rhaos4.12.git0a083f9.el9
  • cri-o openshift 4.11 1.24.4-10.rhaos4.11.git1ed5ac5.el8
  • cri-o openshift 4.12 1.25.2-10.rhaos4.12.git0a083f9.el8
  • cri-o openshift 4.12 1.25.2-9.rhaos4.12.git0a083f9.el9

red hat advisories RHSA-2023:1503RHSA-2023:1033

  • cri-o Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.26.2-r0

alpine advisories ALPINE-CVE-2022-4318

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cri-o CBL-Mariner 2.0 1.22.3-1

azure linux advisories AZL-39873

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-4318 updated cvss 7.8

cri-o: /etc/passwd tampering privesc

  • Red Hat OpenShift Container Platform 4.11 cri-o 1.24.4-10.rhaos4.11.git1ed5ac5.el8
    fixed: vendor fix RHSA-2023:1503
  • Red Hat OpenShift Container Platform 4.12 cri-o 1.25.2-9.rhaos4.12.git0a083f9.el9, cri-o 1.25.2-10.rhaos4.12.git0a083f9.el8
    fixed: vendor fix RHSA-2023:1033
  • Red Hat Enterprise Linux 9 fence-virt, fence-virtd, fence-agents, fence-virtd-cpg, fence-virtd-tcp, fence-agents-all, +51 more Red Hat OpenShift Container Platform 4.11 openshift 4.11.0-202303240327.p0.gaf0420d.assembly.stream.el8, openshift-kuryr 4.11.0-202303240327.p0.g93daed6.assembly.stream.el8, openshift-ansible 4.11.0-202303240327.p0.gdf73941.assembly.stream.el8, openshift-clients 4.11.0-202303240327.p0.gdea6f47.assembly.stream.el8, openshift-hyperkube 4.11.0-202303240327.p0.gaf0420d.assembly.stream.el8, openshift-kuryr-cni 4.11.0-202303240327.p0.g93daed6.assembly.stream.el8, +6 more Red Hat OpenShift Container Platform 4.12 perf 4.18.0-372.46.1.el8_6, kernel 4.18.0-372.46.1.el8_6, bpftool 4.18.0-372.46.1.el8_6, kernel-core 4.18.0-372.46.1.el8_6, kernel-tools 4.18.0-372.46.1.el8_6, python3-perf 4.18.0-372.46.1.el8_6, +36 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 6.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/cri-o/cri-o
<1.26.0
1.26.0

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.11
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory
  • CWE-913 Improper Control of Dynamically-Managed Code Resources

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.