New Vulnerability in CRI-O Engine Lets Attackers Escape Kubernetes Containers

A newly disclosed security vulnerability in the Kubernetes
container engine CRI-O called cr8escape could be
exploited by an attacker to break out of containers and obtain root
access to the host.

“Invocation of CVE-2022-0811 can allow an attacker to perform a
variety of actions on objectives, including execution of malware,
exfiltration of data, and lateral movement across pods,”
CrowdStrike researchers John Walker and Manoj Ahuje said^[1]
in an analysis published this week.

A lightweight alternative to Docker, CRI-O^[2]
is a container
runtime^[3] implementation of the
Kubernetes Container Runtime Interface (CRI) that’s used to pull
container images from registries and launch an Open Container
Initiative (OCI^[4])-compatible runtime such
as runC to spawn and run container processes.

The vulnerability is rated 8.8 on the CVSS vulnerability scoring
system and affects CRI-O versions 1.19 and later. Following
responsible disclosure, patches have been released to address the
flaw in version 1.23.2^[5]
shipped on March 15, 2022.

CVE-2022-0811 stems from a code change^[6]
introduced in version1.19 to set kernel options for a pod,
resulting in a scenario where a bad actor with permissions to
deploy a pod on a Kubernetes cluster using the CRI-O runtime can
take advantage of the “kernel.core_pattern^[7]” parameter to achieve
container escape and arbitrary code execution as root on any node
in the cluster.

The parameter “kernel.core_pattern” is used to specify a pattern
name for a core dump^[8], which is a file
containing the memory snapshot of a program at a specific time
that’s typically activated in response to unexpected crashes or
when the process terminates abnormally.

“If the first character of the pattern is a ‘|’ [a pipe^[9]], the kernel will treat
the rest of the pattern as a command to run. The core dump will be
written to the standard input of that program instead of to a
file,” reads the Linux kernel documentation^[10].

Therefore, by setting this option to point to a malicious shell
script and triggering a core dump, the vulnerability leads to the
invocation of the script, effectively achieving remote code
execution and granting the adversary the ability to take over the
node.

“Kubernetes is not necessary to invoke CVE-2022-8011,” the
researchers pointed out. “An attacker on a machine with CRI-O
installed can use it to set kernel parameters all by itself.”