exploitDog

CVE-2022-1708

Опубликовано: 07 июн. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 7.8

EPSS Низкий

Описание

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

Ссылки

https://bugzilla.redhat.com/show_bug.cgi?id=2085361
Issue Tracking
Third Party Advisory
https://github.com/cri-o/cri-o/commit/f032cf649ecc7e0c46718bd9e7814bfb317cb544
Patch
https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j
Exploit
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2085361
Issue Tracking
Third Party Advisory
https://github.com/cri-o/cri-o/commit/f032cf649ecc7e0c46718bd9e7814bfb317cb544
Patch
https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:*

Версия до 1.19.7 (исключая)

cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:*

Версия от 1.20.0 (включая) до 1.20.8 (исключая)

cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:*

Версия от 1.21.0 (включая) до 1.21.8 (исключая)

cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:*

Версия от 1.22.0 (включая) до 1.22.5 (исключая)

cpe:2.3:a:kubernetes:cri-o:*:*:*:*:*:*:*:*

Версия от 1.23.0 (включая) до 1.23.3 (исключая)

cpe:2.3:a:kubernetes:cri-o:1.24.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 55%

0.00326

Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400

CWE-770

Связанные уязвимости

CVE-2022-1708

CVSS3: 7.5

ubuntu

около 3 лет назад

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

CVE-2022-1708

CVSS3: 6.8

redhat

около 3 лет назад

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

CVE-2022-1708

CVSS3: 7.5

msrc

около 1 года назад

Описание отсутствует

CVE-2022-1708

CVSS3: 7.5

debian

около 3 лет назад

A vulnerability was found in CRI-O that causes memory or disk space ex ...

SUSE-SU-2022:4635-1

suse-cvrf

больше 2 лет назад

Security update for conmon

EPSS

Процентиль: 55%

0.00326

Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Дефекты

CWE-400

CWE-770