CVE-2023-6476 — Allocation of Resources Without Limits or Throttling in Redhat Openshift Container Platform

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-400 — Uncontrolled Resource Consumption7 documents6 sources
Severity
7.5HIGHNVD
CNA6.5
EPSS
0.3%
top 46.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Cri-o Cri-oRedhat Openshift Container Platform
Timeline
PublishedJan 9
Latest updateJun 28

Description

A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶Gogithub.com/cri-o_cri-o1.28.0 — 1.28.3+2

Also affects: Openshift Container Platform 3.11, 4.13, 4.14

🔴Vulnerability Details

4
OSV
CRI-O's pods can break out of resource confinement on cgroupv2 in github.com/cri-o/cri-o↗2024-06-28
▶
OSV
CRI-O's pods can break out of resource confinement on cgroupv2↗2024-01-10
▶
GHSA
CRI-O's pods can break out of resource confinement on cgroupv2↗2024-01-10
▶
CVEList
Cri-o: pods are able to break out of resource confinement on cgroupv2↗2024-01-09
▶

📋Vendor Advisories

2
Red Hat
cri-o: Pods are able to break out of resource confinement on cgroupv2↗2024-01-09
▶
Microsoft
Cri-o: pods are able to break out of resource confinement on cgroupv2↗2024-01-09
▶
CVE-2023-6476 — Redhat vulnerability | cvebase