What’s Vulnerable › Vulnerabilities

CVE-2022-0811

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 19.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-16 · updated 2026-06-17
• Weakness: CWE-94

Description

A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.

Affected products

• cri-o: from 1.19.0 before 1.19.6; from 1.20.0 before 1.20.7; from 1.21.0 before 1.21.6; from 1.22.0 before 1.22.3; from 1.23.0 before 1.23.2 — fixed in 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2

How to fix

Upgrade to a fixed version: cri-o 1.19.6, 1.20.7, 1.21.6, 1.22.3. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2059475
• https://github.com/cri-o/cri-o/security/advisories/GHSA-6x2m-w449-qwx7
• https://bugzilla.redhat.com/show_bug.cgi?id=2059475
• https://github.com/cri-o/cri-o/security/advisories/GHSA-6x2m-w449-qwx7

Get alerted when CVE-2022-0811 or the next vulnerability affects your stack