Every CVE Search/ Get API key

CVE-2022-0532

Incorrect Permission Assignment for Critical Resource in CRI-O

4.2 MediumFix available

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.77%Down 0.1 points since Feb 10, 2022
90%50%10%1%

What each source reports

NVD Score used 4.2

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Record
CVE-2022-0532
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS 2.0
4.9 MediumAV:N/AC:M/Au:S/C:P/I:N/A:P
Weakness
CWE-732
Updated
2026-11-02
CVE List No score

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Record
CVE-2022-0532
Weakness
CWE-732
Updated
2026-11-02
EUVDEUVD-2022-1081 No score

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Record
EUVD-2022-1081
Updated
2026-11-03
GitHub AdvisoriesGHSA-jqmc-79gx-7g8p 4.2

Incorrect Permission Assignment for Critical Resource in CRI-O

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Record
GHSA-jqmc-79gx-7g8p
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-732
Updated
2026-11-02
OSVGHSA-jqmc-79gx-7g8p 4.2

Incorrect Permission Assignment for Critical Resource in CRI-O

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Record
GHSA-jqmc-79gx-7g8p
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-732
Updated
2026-11-02
OSVRHBA-2022:0793 4.2

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.8.34 packages update

Record
RHBA-2022:0793
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
Show 6 moreShow less
OSVRHBA-2022:0794 4.2

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.9.24 packages update

Record
RHBA-2022:0794
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-02
OSVRHSA-2022:0055 9.0

Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update

Record
RHSA-2022:0055
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0866 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.6.56 packages and security update

Record
RHSA-2022:0866
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0870 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.7.45 packages and security update

Record
RHSA-2022:0870
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV No score

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

Record
CVE-2022-0532
Weakness
CWE-732
Updated
2026-11-02
OSVGO-2022-0608 No score

Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o

Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o

Record
GO-2022-0608
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/cri-o/cri-o
Go
 before 1.23.1
1.23.1
cri-o
Red Hat:openshift:4.8::el7
 before 0:1.21.5-2.rhaos4.8.gitaf64931.el7
0:1.21.5-2.rhaos4.8.gitaf64931.el7
cri-o-debuginfo
Red Hat:openshift:4.8::el7
 before 0:1.21.5-2.rhaos4.8.gitaf64931.el7
0:1.21.5-2.rhaos4.8.gitaf64931.el7
cri-o
Red Hat:openshift:4.8::el8
 before 0:1.21.5-2.rhaos4.8.gitaf64931.el8
0:1.21.5-2.rhaos4.8.gitaf64931.el8
cri-o-debuginfo
Red Hat:openshift:4.8::el8
 before 0:1.21.5-2.rhaos4.8.gitaf64931.el8
0:1.21.5-2.rhaos4.8.gitaf64931.el8
cri-o-debugsource
Red Hat:openshift:4.8::el8
 before 0:1.21.5-2.rhaos4.8.gitaf64931.el8
0:1.21.5-2.rhaos4.8.gitaf64931.el8
cri-o
Red Hat:openshift:4.9::el7
 before 0:1.22.2-2.rhaos4.9.gitb030be8.el7
0:1.22.2-2.rhaos4.9.gitb030be8.el7
cri-o-debuginfo
Red Hat:openshift:4.9::el7
 before 0:1.22.2-2.rhaos4.9.gitb030be8.el7
0:1.22.2-2.rhaos4.9.gitb030be8.el7
cri-o
Red Hat:openshift:4.9::el8
 before 0:1.22.2-2.rhaos4.9.gitb030be8.el8
0:1.22.2-2.rhaos4.9.gitb030be8.el8
cri-o-debuginfo
Red Hat:openshift:4.9::el8
 before 0:1.22.2-2.rhaos4.9.gitb030be8.el8
0:1.22.2-2.rhaos4.9.gitb030be8.el8
Show 31 moreShow less
Affected packages
PackageAffectedFixed
cri-o-debugsource
Red Hat:openshift:4.9::el8
 before 0:1.22.2-2.rhaos4.9.gitb030be8.el8
0:1.22.2-2.rhaos4.9.gitb030be8.el8
jenkins
Red Hat:openshift:4.10::el8
 before 0:2.319.2.1643288987-1.el8
0:2.319.2.1643288987-1.el8
coreos-installer
Red Hat:openshift:4.10::el8
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
coreos-installer-bootinfra
Red Hat:openshift:4.10::el8
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
coreos-installer-bootinfra-debuginfo
Red Hat:openshift:4.10::el8
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
coreos-installer-debuginfo
Red Hat:openshift:4.10::el8
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
coreos-installer-debugsource
Red Hat:openshift:4.10::el8
 before 0:0.12.0-1.rhaos4.10.el8
0:0.12.0-1.rhaos4.10.el8
jenkins-2-plugins
Red Hat:openshift:4.10::el8
 before 0:4.10.1643404185-1.el8
0:4.10.1643404185-1.el8
cri-o
Red Hat:openshift:4.10::el7
 before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
cri-o-debuginfo
Red Hat:openshift:4.10::el7
 before 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
0:1.23.0-92.rhaos4.10.gitdaab4d1.el7
cri-o
Red Hat:openshift:4.10::el8
 before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
cri-o-debuginfo
Red Hat:openshift:4.10::el8
 before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
cri-o-debugsource
Red Hat:openshift:4.10::el8
 before 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
0:1.23.1-9.rhaos4.10.gitbdffb9a.el8
openshift
Red Hat:openshift:4.10::el7
 before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
openshift-clients
Red Hat:openshift:4.10::el7
 before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7
0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7
openshift-clients-redistributable
Red Hat:openshift:4.10::el7
 before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7
0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7
openshift-hyperkube
Red Hat:openshift:4.10::el7
 before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7
openshift
Red Hat:openshift:4.10::el8
 before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
openshift-clients
Red Hat:openshift:4.10::el8
 before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
openshift-clients-redistributable
Red Hat:openshift:4.10::el8
 before 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8
openshift-hyperkube
Red Hat:openshift:4.10::el8
 before 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8
cri-o
Red Hat:openshift:4.6::el7
 before 0:1.19.5-3.rhaos4.6.git91f8458.el7
0:1.19.5-3.rhaos4.6.git91f8458.el7
cri-o-debuginfo
Red Hat:openshift:4.6::el7
 before 0:1.19.5-3.rhaos4.6.git91f8458.el7
0:1.19.5-3.rhaos4.6.git91f8458.el7
cri-o
Red Hat:openshift:4.6::el8
 before 0:1.19.5-3.rhaos4.6.git91f8458.el8
0:1.19.5-3.rhaos4.6.git91f8458.el8
cri-o-debuginfo
Red Hat:openshift:4.6::el8
 before 0:1.19.5-3.rhaos4.6.git91f8458.el8
0:1.19.5-3.rhaos4.6.git91f8458.el8
cri-o-debugsource
Red Hat:openshift:4.6::el8
 before 0:1.19.5-3.rhaos4.6.git91f8458.el8
0:1.19.5-3.rhaos4.6.git91f8458.el8
cri-o
Red Hat:openshift:4.7::el7
 before 0:1.20.6-11.rhaos4.7.git76ea3d0.el7
0:1.20.6-11.rhaos4.7.git76ea3d0.el7
cri-o-debuginfo
Red Hat:openshift:4.7::el7
 before 0:1.20.6-11.rhaos4.7.git76ea3d0.el7
0:1.20.6-11.rhaos4.7.git76ea3d0.el7
cri-o
Red Hat:openshift:4.7::el8
 before 0:1.20.6-11.rhaos4.7.git76ea3d0.el8
0:1.20.6-11.rhaos4.7.git76ea3d0.el8
cri-o-debuginfo
Red Hat:openshift:4.7::el8
 before 0:1.20.6-11.rhaos4.7.git76ea3d0.el8
0:1.20.6-11.rhaos4.7.git76ea3d0.el8
cri-o-debugsource
Red Hat:openshift:4.7::el8
 before 0:1.20.6-11.rhaos4.7.git76ea3d0.el8
0:1.20.6-11.rhaos4.7.git76ea3d0.el8

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-0532 is a medium vulnerability (CVSS 4.2) in Kubernetes Cri-o, published February 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in github.com/cri-o/cri-o 1.23.1.

References

Show 126 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open