Cri-o: pods are able to break out of resource confinement on cgroupv2

CVE-2023-6476

Summary

A critical flaw exists in the CRI-O runtime, which is related to experimental annotations that can lead to a container running in an unconfined state. This vulnerability allows a pod to gain control over memory and CPU resources beyond standard limits, effectively bypassing the Kubernetes scheduler's resource management. The repercussions of this vulnerability could include a denial of service on the affected node, as it can lead to resource exhaustion and instability. Monitoring and patching affected versions are essential to mitigate risks associated with this vulnerability.

References