Description
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat OpenShift Container Platform 4.13
Default version status: affected
0:1.26.4-6.1.rhaos4.13.git9eb9cf3.el9 to < *unaffected
Red Hat Red Hat OpenShift Container Platform 4.14
Default version status: affected
0:1.27.2-7.rhaos4.14.git1cc7a64.el9 to < *unaffected
Red Hat Red Hat OpenShift Container Platform 3.11
Default version status: unknown