Security Vulnerability in CRI-O Could Affect OpenShift Users

Crowdstrike researchers have detected an exploit called “cr8escape” in the CRI-O Container Engine. The vulnerability has a CVE rating of 8.8/10 (High), and it has been disclosed that it affects software and platforms using CRI-O.

It is stated that attackers exploiting this vulnerability could escape the Kubernetes container, gain root access, and then access any part of the cluster.

Directly affected software versions:

• CRI-O version 1.19+

Indirectly affected software and platforms:

• OpenShift 4+
• Oracle Container Engine for Kubernetes

Solution:

At the Kubernetes level:

• The ideal solution is to block pods by using “+=” values in the sysctl commands.
• As a secondary solution, the PodSecurityPolicy with the forbiddenSysctls field can be used to block all sysctls.

At the CRI-O level:

• Upgrade CRI-O to the latest patched version (version 1.23.2).
• Add the -s parameter to the pinns_path in the CRI-O config file to prevent violations related to pod kernel parameters.
• Downgrading to CRI-O version 1.18 or earlier (not generally recommended).