What’s Vulnerable › Vulnerabilities

CVE-2022-4318: Cri-o: /etc/passwd tampering privesc

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-25 · updated 2026-06-17
• Weakness: CWE-538

Description

A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Affected products

• Fedoraproject Extra Packages For Enterprise Linux: 8.0
• Fedoraproject Fedora: 36, 37
• cri-o: all versions
• RedHat Openshift Container Platform For Arm64: 4.12, 4.11
• RedHat Openshift Container Platform For Linuxone: 4.12, 4.11
• RedHat Openshift Container Platform For Power: 4.12, 4.11
• RedHat Openshift Container Platform Ibm Z Systems: 4.12, 4.11

References

• https://access.redhat.com/errata/RHSA-2023:1033
• https://access.redhat.com/errata/RHSA-2023:1503
• https://access.redhat.com/security/cve/CVE-2022-4318
• https://bugzilla.redhat.com/show_bug.cgi?id=2152703
• https://access.redhat.com/errata/RHSA-2023:1033
• https://access.redhat.com/errata/RHSA-2023:1503
• https://access.redhat.com/security/cve/CVE-2022-4318
• https://bugzilla.redhat.com/show_bug.cgi?id=2152703

Get alerted when CVE-2022-4318 or the next vulnerability affects your stack