{"id":"CVE-2023-6476","aliases":["AZL-53405","EUVD-2024-0390","GHSA-p4rx-7wvg-fwrc","GO-2024-2458","RHSA-2024:0195","RHSA-2024:0207"],"status":"published","title":"Cri-o: pods are able to break out of resource confinement on cgroupv2","description":"A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00859,"percentile":0.58783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2024-01-09T21:32:03Z","modified":"2026-10-16T10:03:24Z","fixes":[{"ecosystem":"Go","package":"github.com/cri-o/cri-o","fixed_in":["1.29.1","1.28.3","1.27.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"cri-o","fixed_in":["1.22.3-10"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o","fixed_in":["0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debuginfo","fixed_in":["0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debugsource","fixed_in":["0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o","fixed_in":["0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debuginfo","fixed_in":["0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debugsource","fixed_in":["0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.29.0"},{"last_affected":"1.29.0"},{"fixed":"1.29.1"}]}],"versions":["1.29.0"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0"},{"fixed":"1.28.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"1.29.0"},{"fixed":"1.29.1"}]}],"versions":["1.29.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"1.28.0"},{"fixed":"1.28.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/cri-o/cri-o","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.3"},{"introduced":"1.28.0"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.13::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-7.rhaos4.14.git1cc7a64.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-7.rhaos4.14.git1cc7a64.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-7.rhaos4.14.git1cc7a64.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-7.rhaos4.14.git1cc7a64.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-7.rhaos4.14.git1cc7a64.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.14::el9","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.27.2-7.rhaos4.14.git1cc7a64.el9"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat openshift container platform 3.11"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:0195","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0207","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6476","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253994","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","web","report"]},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-p4rx-7wvg-fwrc","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6476","tags":["web","advisory"]},{"url":"https://github.com/cri-o/cri-o/pull/4479","tags":["web","fix"]},{"url":"https://github.com/cri-o/cri-o/commit/75effcb1a25851a736e82dba1f7d8cee93ee159e","tags":["web","fix"]},{"url":"https://github.com/cri-o/cri-o/blob/main/pkg/config/workloads.go#L103-L107","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p4rx-7wvg-fwrc"},{"url":"https://github.com/cri-o/cri-o","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0195.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6476","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251198","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0207.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-47108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47108","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2023-6476","title":"Cri-o: pods are able to break out of resource confinement on cgroupv2","description":"A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.","status":"published","published":"2024-01-09T21:32:03.407Z","modified":"2025-11-20T18:05:55.102Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2024-0390","description":"A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.","status":"published","published":"2024-01-09T21:32:03Z","modified":"2025-11-20T18:05:55Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:14.564249Z"}],"ghsa":[{"id":"GHSA-p4rx-7wvg-fwrc","title":"CRI-O's pods can break out of resource confinement on cgroupv2","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAll versions of CRI-O running on cgroupv2 nodes. \nUnchecked access to an experimental annotation allows a container to be unconfined. Back in 2021, [support was added](https://github.com/cri-o/cri-o/pull/4479) to support an experimental annotation that allows a user to request special resources in cgroupv2. It was supposed to be gated by an experimental annotation: `io.kubernetes.cri-o.UnifiedCgroup`, which was supposed to be filtered from the [list of allowed annotations](https://github.com/cri-o/cri-o/blob/main/pkg/config/workloads.go#L103-L107) . However, there is a bug in this code which allows any user to specify this annotation, regardless of whether it's enabled on the node. The consequences of this are a pod can specify any amount of memory/cpu and get it, circumventing the kubernetes scheduler, and potentially be able to DOS a node. \n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n1.29.1, 1.28.3, 1.27.3\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nuse cgroupv1\n\n### References\n_Are there any links users can visit to find out more?_\n","status":"published","published":"2024-01-10T15:27:45Z","modified":"2024-01-19T19:46:28Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2023-6476","description":"A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.","status":"published","published":"2024-01-09T22:15:43.61Z","modified":"2026-06-17T06:50:49.193Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:09:00.788714Z"}],"osv":[{"id":"AZL-53405","title":"CVE-2023-6476 affecting package cri-o for versions less than 1.22.3-10","description":"A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.","status":"published","published":"2024-01-09T22:15:43Z","modified":"2026-04-21T04:35:14.336529Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.595149Z"},{"id":"GHSA-p4rx-7wvg-fwrc","title":"CRI-O's pods can break out of resource confinement on cgroupv2","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAll versions of CRI-O running on cgroupv2 nodes. \nUnchecked access to an experimental annotation allows a container to be unconfined. Back in 2021, [support was added](https://github.com/cri-o/cri-o/pull/4479) to support an experimental annotation that allows a user to request special resources in cgroupv2. It was supposed to be gated by an experimental annotation: `io.kubernetes.cri-o.UnifiedCgroup`, which was supposed to be filtered from the [list of allowed annotations](https://github.com/cri-o/cri-o/blob/main/pkg/config/workloads.go#L103-L107) . However, there is a bug in this code which allows any user to specify this annotation, regardless of whether it's enabled on the node. The consequences of this are a pod can specify any amount of memory/cpu and get it, circumventing the kubernetes scheduler, and potentially be able to DOS a node. \n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n1.29.1, 1.28.3, 1.27.3\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nuse cgroupv1\n\n### References\n_Are there any links users can visit to find out more?_\n","status":"published","published":"2024-01-10T15:27:45Z","modified":"2024-06-28T15:58:33.081759Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"RHSA-2024:0195","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.29 packages and security update","status":"published","published":"2024-09-16T16:52:14Z","modified":"2026-08-07T10:11:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0207","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.9 packages and security update","status":"published","published":"2024-09-30T13:40:00Z","modified":"2026-10-16T10:03:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"GO-2024-2458","title":"CRI-O's pods can break out of resource confinement on cgroupv2 in github.com/cri-o/cri-o","description":"CRI-O's pods can break out of resource confinement on cgroupv2 in github.com/cri-o/cri-o","status":"published","published":"2024-06-28T15:28:53Z","modified":"2026-03-03T04:54:28.373884Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}