Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

New Vulnerability Affecting Container Engines CRI-O and Podman (CVE-2021-20291)

Summary: Unit 42 found CVE-2021-20291 in the containers/storage Go library, which causes a deadlock and denial of service in the container engines CRI-O and Podman when they pull a malicious image from a registry. The vulnerability was disclosed March 10, 2021, with fixes in containers/storage 1.28.1, CRI-O v1.20.2 and Podman 3.1.0.

What you should know: A single malicious image pulled to multiple nodes can crash them all and break a cluster, with no fix short of restarting the nodes - and since Kubernetes v1.20 dropped Docker, CRI-O is one of only two supported engines, so many clusters run it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Endpoint & Network Security
Mentions
CVE-2021-20291
Related