{"id":"CVE-2022-0532","aliases":["EUVD-2022-1081","GHSA-jqmc-79gx-7g8p","GO-2022-0608","RHBA-2022:0793","RHBA-2022:0794","RHSA-2022:0055","RHSA-2022:0866","RHSA-2022:0870"],"status":"published","title":"Incorrect Permission Assignment for Critical Resource in CRI-O","description":"An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of \"safe\" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00765,"percentile":0.55759,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2022-02-09T22:05:13Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Go","package":"github.com/cri-o/cri-o","fixed_in":["1.23.1"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:openshift:4.8::el7","package":"cri-o","fixed_in":["0:1.21.5-2.rhaos4.8.gitaf64931.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.8::el7","package":"cri-o-debuginfo","fixed_in":["0:1.21.5-2.rhaos4.8.gitaf64931.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o","fixed_in":["0:1.21.5-2.rhaos4.8.gitaf64931.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o-debuginfo","fixed_in":["0:1.21.5-2.rhaos4.8.gitaf64931.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o-debugsource","fixed_in":["0:1.21.5-2.rhaos4.8.gitaf64931.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.9::el7","package":"cri-o","fixed_in":["0:1.22.2-2.rhaos4.9.gitb030be8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.9::el7","package":"cri-o-debuginfo","fixed_in":["0:1.22.2-2.rhaos4.9.gitb030be8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.9::el8","package":"cri-o","fixed_in":["0:1.22.2-2.rhaos4.9.gitb030be8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.9::el8","package":"cri-o-debuginfo","fixed_in":["0:1.22.2-2.rhaos4.9.gitb030be8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.9::el8","package":"cri-o-debugsource","fixed_in":["0:1.22.2-2.rhaos4.9.gitb030be8.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.23.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.23.1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.5-2.rhaos4.8.gitaf64931.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.5-2.rhaos4.8.gitaf64931.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.5-2.rhaos4.8.gitaf64931.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.5-2.rhaos4.8.gitaf64931.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.8::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.5-2.rhaos4.8.gitaf64931.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-2.rhaos4.9.gitb030be8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-2.rhaos4.9.gitb030be8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-2.rhaos4.9.gitb030be8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-2.rhaos4.9.gitb030be8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.9::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.2-2.rhaos4.9.gitb030be8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1643288987-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-bootinfra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-bootinfra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.1643404185-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-92.rhaos4.10.gitdaab4d1.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-92.rhaos4.10.gitdaab4d1.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-3.rhaos4.6.git91f8458.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-3.rhaos4.6.git91f8458.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-3.rhaos4.6.git91f8458.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-3.rhaos4.6.git91f8458.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.6::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.19.5-3.rhaos4.6.git91f8458.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.6-11.rhaos4.7.git76ea3d0.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.6-11.rhaos4.7.git76ea3d0.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.6-11.rhaos4.7.git76ea3d0.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.6-11.rhaos4.7.git76ea3d0.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.7::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.6-11.rhaos4.7.git76ea3d0.el8"}]}],"bundled":2}],"products":[{"vendor":"kubernetes","product":"cri-o"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051730","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0532","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o/pull/5610","tags":["web","fix"]},{"url":"https://github.com/cri-o/cri-o/releases/tag/v1.23.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jqmc-79gx-7g8p","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0532.json","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o","tags":["package"]},{"url":"https://access.redhat.com/errata/RHBA-2022:0793","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062076","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_0793.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0532","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0532","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-w2j5-3rcx-vx7x","tags":["article"]},{"url":"https://access.redhat.com/errata/RHBA-2022:0794","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2062080","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_0794.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0055","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030806","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0055.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20319","tags":["advisory"]},{"url":"https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21684","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2499","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21685","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21686","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21687","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21688","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21689","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21690","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020339","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21693","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21694","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21695","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21695","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21696","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2423","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21697","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020385","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21698","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2506","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41190","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41190","tags":["advisory"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-xmmx-7jpf-fx42","tags":["article"]},{"url":"https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m","tags":["article"]},{"url":"https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41772","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/0fM21h43arc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/hcmEScgc00k","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44717","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-20612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20612","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-20617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20617","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1878","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0866","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2059475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064006","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0866.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0811","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0811","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-6x2m-w449-qwx7","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0870","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064013","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0870.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-0532","description":"An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of \"safe\" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.","status":"published","published":"2022-02-09T22:05:13Z","modified":"2024-08-02T23:32:45.993Z","cwes":["CWE-732"],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-1081","description":"An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of \"safe\" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.","status":"published","published":"2022-02-09T22:05:13Z","modified":"2024-08-02T23:32:45Z","updated_at":"2026-11-03T03:26:04.946671Z"}],"ghsa":[{"id":"GHSA-jqmc-79gx-7g8p","title":"Incorrect Permission Assignment for Critical Resource in CRI-O","description":"An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of \"safe\" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.","status":"published","published":"2022-02-11T00:00:54Z","modified":"2023-02-03T05:05:59Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:36:43.439065Z"}],"nvd":[{"id":"CVE-2022-0532","description":"An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of \"safe\" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.","status":"published","published":"2022-02-09T23:15:16.72Z","modified":"2026-06-17T04:20:47.367Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"GHSA-jqmc-79gx-7g8p","title":"Incorrect Permission Assignment for Critical Resource in CRI-O","description":"An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of \"safe\" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.","status":"published","published":"2022-02-11T00:00:54Z","modified":"2024-08-21T15:42:04.628055Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"RHBA-2022:0793","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.8.34 packages update","status":"published","published":"2024-09-16T07:05:54Z","modified":"2025-11-22T12:28:30Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2022:0794","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.9.24 packages update","status":"published","published":"2024-09-16T07:06:01Z","modified":"2025-11-22T12:28:30Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2022:0055","title":"Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update","status":"published","published":"2024-09-30T14:19:01Z","modified":"2026-08-20T10:02:39Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0866","title":"Red Hat Security Advisory: OpenShift Container Platform 4.6.56 packages and security update","status":"published","published":"2024-09-16T07:35:32Z","modified":"2025-11-22T12:31:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0870","title":"Red Hat Security Advisory: OpenShift Container Platform 4.7.45 packages and security update","status":"published","published":"2024-09-16T07:35:18Z","modified":"2025-11-22T12:31:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"CVE-2022-0532","description":"An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of \"safe\" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.","status":"published","published":"2022-02-09T22:05:13Z","modified":"2026-10-28T02:31:13.228286737Z","cwes":["CWE-732"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"GO-2022-0608","title":"Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o","description":"Incorrect Permission Assignment for Critical Resource in CRI-O in github.com/cri-o/cri-o","status":"published","published":"2024-08-21T15:11:38Z","modified":"2026-03-03T04:50:45.074229Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}