6.6Media
CVE-2025-0750Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting
Descripción
A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.
Debilidad (CWE):
CWE-22
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| openshift | 4.17 | — | |
| openshift | 4.18 | — | |
| openshift ironic | 4.18 | — | |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | all versions | |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | all versions | |
| — | cri-o | < 1.33.1 |
Referencias y parches
- RHEA-2024:6126 vendor-advisory
- RHSA-2025:1122 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-0750 vdb-entry
- RHBZ#2339405 issue-tracking