CVE-2019-14891

2019-11-2510:31:17

CWE-460

redhat

www.cve.org

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

31.4%

JSON

A flaw was found in cri-o, as a result of all pod-related processes being placed in the same memory cgroup. This can result in container management (conmon) processes being killed if a workload process triggers an out-of-memory (OOM) condition for the cgroup. An attacker could abuse this flaw to get host network access on an cri-o host.

CNA Affected

[
  {
    "product": "cri-o",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]