CVE-2023-6476
Cri-o: pods are able to break out of resource confinement on cgroupv2
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cri-o: pods are able to break out of resource confinement on cgroupv2
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
- Record
CVE-2023-6476- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2024-0390
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
- Record
EUVD-2024-0390- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p4rx-7wvg-fwrc
CRI-O's pods can break out of resource confinement on cgroupv2
Impact
What kind of vulnerability is it? Who is impacted?
All versions of CRI-O running on cgroupv2 nodes.
Unchecked access to an experimental annotation allows a container to be unconfined. Back in 2021, support was added to support an experimental annotation that allows a user to request special resources in cgroupv2. It was supposed to be gated by an experimental annotation: io.kubernetes.cri-o.UnifiedCgroup, which was supposed to be filtered from the list of allowed annotations . However, there is a bug in this code which allows any user to specify this annotation, regardless of whether it's enabled on the node. The consequences of this are a pod can specify any amount of memory/cpu and get it, circumventing the kubernetes scheduler, and potentially be able to DOS a node.
Patches
Has the problem been patched? What versions should users upgrade to? 1.29.1, 1.28.3, 1.27.3
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? use cgroupv1
References
Are there any links users can visit to find out more?
- Record
GHSA-p4rx-7wvg-fwrc- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
NVD
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
- Record
CVE-2023-6476- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVAZL-53405
CVE-2023-6476 affecting package cri-o for versions less than 1.22.3-10
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
- Record
AZL-53405- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-p4rx-7wvg-fwrc
CRI-O's pods can break out of resource confinement on cgroupv2
Impact
What kind of vulnerability is it? Who is impacted?
All versions of CRI-O running on cgroupv2 nodes.
Unchecked access to an experimental annotation allows a container to be unconfined. Back in 2021, support was added to support an experimental annotation that allows a user to request special resources in cgroupv2. It was supposed to be gated by an experimental annotation: io.kubernetes.cri-o.UnifiedCgroup, which was supposed to be filtered from the list of allowed annotations . However, there is a bug in this code which allows any user to specify this annotation, regardless of whether it's enabled on the node. The consequences of this are a pod can specify any amount of memory/cpu and get it, circumventing the kubernetes scheduler, and potentially be able to DOS a node.
Patches
Has the problem been patched? What versions should users upgrade to? 1.29.1, 1.28.3, 1.27.3
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading? use cgroupv1
References
Are there any links users can visit to find out more?
- Record
GHSA-p4rx-7wvg-fwrc- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVRHSA-2024:0195
Red Hat Security Advisory: OpenShift Container Platform 4.13.29 packages and security update
- Record
RHSA-2024:0195- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:0207
Red Hat Security Advisory: OpenShift Container Platform 4.14.9 packages and security update
- Record
RHSA-2024:0207- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGO-2024-2458 No score
CRI-O's pods can break out of resource confinement on cgroupv2 in github.com/cri-o/cri-o
CRI-O's pods can break out of resource confinement on cgroupv2 in github.com/cri-o/cri-o
- Record
GO-2024-2458- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cri-o/cri-oGo |
1.29.0 to 1.29.0 | 1.29.1 |
github.com/cri-o/cri-oGo |
1.28.0 up to 1.28.3 | 1.28.3 |
github.com/cri-o/cri-oGo |
before 1.27.3 | 1.27.3 |
cri-oAzure Linux:2 |
before 1.22.3-10 | 1.22.3-10 |
github.com/cri-o/cri-oGo |
1.29.0 up to 1.29.1 | 1.29.1 |
github.com/cri-o/cri-oGo |
before 1.27.3, 1.28.0 up to 1.28.3, 1.29.0 up to 1.29.1 | 1.27.31.28.31.29.1 |
cri-oRed Hat:openshift:4.13::el8 |
before 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 |
cri-o-debuginfoRed Hat:openshift:4.13::el8 |
before 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 |
cri-o-debugsourceRed Hat:openshift:4.13::el8 |
before 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8 |
cri-oRed Hat:openshift:4.13::el9 |
before 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cri-o-debuginfoRed Hat:openshift:4.13::el9 |
before 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 |
cri-o-debugsourceRed Hat:openshift:4.13::el9 |
before 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 | 0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 |
cri-oRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 | 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 |
cri-o-debuginfoRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 | 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 |
cri-o-debugsourceRed Hat:openshift:4.14::el8 From an advisory covering 2 CVEs |
before 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 | 0:1.27.2-7.rhaos4.14.git1cc7a64.el8 |
cri-oRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 | 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 |
cri-o-debuginfoRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 | 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 |
cri-o-debugsourceRed Hat:openshift:4.14::el9 From an advisory covering 2 CVEs |
before 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 | 0:1.27.2-7.rhaos4.14.git1cc7a64.el9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-6476 is a medium vulnerability (CVSS 6.5) in Red Hat Openshift Container Platform 3.11, published January 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in github.com/cri-o/cri-o 1.29.1.
References
access.redhat.com/errata/RHSA-2024:0195
bugzilla.redhat.com/show_bug.cgi?id=2253994
github.com/cri-o/cri-o/security/advisories/GHSA-p4rx-7wvg-fwrc
nvd.nist.gov/vuln/detail/CVE-2023-6476
Show 14 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0195.json
cve.org/CVERecord?id=CVE-2023-6476