A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.
The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cri-o | Kubernetes | * | 1.16.1 (excluding) |
| Red Hat OpenShift Container Platform 3.11 | RedHat | cri-o-0:1.11.16-0.10.dev.rhaos3.11.git1eee681.el7 | * |
| Red Hat OpenShift Container Platform 4.2 | RedHat | cri-o-0:1.14.12-24.dev.rhaos4.2.gita17905f.el7 | * |