VDB
RHSA-2022%3A6424
RHSA-2022%3A6424
PUBLISHED
CVSS 10 CRITICAL
A flaw was found in the vm2 sandbox when running untrusted code, as the sandbox setup does not manage proper exception handling. This flaw allows an attacker to bypass the sandbox protections and gain remote code execution on the hypervisor host or the host which is running the sandbox.
Risk Scores
CVSS 3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | multicluster-engine/cluster-proxy-addon-rhel8@sha256:a3bf5d87157231f19bc3054b9efc200bd96773a27d0b02898863899702d42973_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/cluster-proxy-addon-rhel8@sha256:a3bf5d87157231f19bc3054b9efc200bd96773a27d0b02898863899702d42973_s390x |
| Red Hat | multicluster-engine/must-gather-rhel8@sha256:d59560be9cb0034af79d161760d0c37cce66711005ab9622d44fe7d411fae84b_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/must-gather-rhel8@sha256:d59560be9cb0034af79d161760d0c37cce66711005ab9622d44fe7d411fae84b_amd64 |
| Red Hat | multicluster-engine/work-rhel8@sha256:f40ecf80720b4aed914eeca34090bbaa3b39d1dc375776abdbfed9305bee24dc_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | * |
| Red Hat | multicluster-engine/hypershift-deployment-controller-rhel8@sha256:6fe0995b4271964d73d1f2c5a4f45086eab44cdddf3e5777faa17219599c55fe_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/hypershift-deployment-controller-rhel8@sha256:6fe0995b4271964d73d1f2c5a4f45086eab44cdddf3e5777faa17219599c55fe_ppc64le |
| Red Hat | multicluster-engine/assisted-installer-agent-rhel8@sha256:724f092c61b49854b0c50cd1f5cadf569c9a636f0a92bcddd17a9cc6d0ca22aa_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/assisted-installer-agent-rhel8@sha256:724f092c61b49854b0c50cd1f5cadf569c9a636f0a92bcddd17a9cc6d0ca22aa_amd64 |
| Red Hat | multicluster-engine/clusterclaims-controller-rhel8@sha256:b5fa13be7d68e1ea2f9d7953813ef31b6efc6bfb4d1c152b7ba3da6899077f17_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/clusterclaims-controller-rhel8@sha256:b5fa13be7d68e1ea2f9d7953813ef31b6efc6bfb4d1c152b7ba3da6899077f17_ppc64le |
| Red Hat | multicluster-engine/clusterclaims-controller-rhel8@sha256:2aef2ebc51b6ad1612828af5d767de30b320b747c3d463b6edea5212c8b17346_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/clusterclaims-controller-rhel8@sha256:2aef2ebc51b6ad1612828af5d767de30b320b747c3d463b6edea5212c8b17346_arm64 |
| Red Hat | multicluster-engine/hypershift-rhel8-operator@sha256:8e941bcc24bb8dd4e9af5238fa2144143b63a12f163051ee84c50ffa0bae10c5_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/hypershift-rhel8-operator@sha256:8e941bcc24bb8dd4e9af5238fa2144143b63a12f163051ee84c50ffa0bae10c5_ppc64le |
| Red Hat | multicluster-engine/registration-operator-rhel8@sha256:9948af4bb81c8420c9919df1af58afc8c10b60326526120ae9f86bdd102e5c17_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/registration-operator-rhel8@sha256:9948af4bb81c8420c9919df1af58afc8c10b60326526120ae9f86bdd102e5c17_arm64 |
| Red Hat | multicluster-engine/cluster-proxy-addon-rhel8@sha256:818a79e2ea7829754a6f3c7f16e688d13c3591a9541091b33527eccb8f7a96e5_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | * |
| Red Hat | multicluster-engine/hypershift-addon-rhel8-operator@sha256:3c4e5309027b401628bafe846b542d2b9e196691be6b37eb1b2a90845afe506c_amd64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/hypershift-addon-rhel8-operator@sha256:3c4e5309027b401628bafe846b542d2b9e196691be6b37eb1b2a90845afe506c_amd64 |
| Red Hat | multicluster-engine/multicluster-engine-cluster-api-provider-agent-rhel8@sha256:e847430cc20c1175ad94efc215c08c85e6d431d9ba12bc2a093ad3fd392f1e6c_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/multicluster-engine-cluster-api-provider-agent-rhel8@sha256:e847430cc20c1175ad94efc215c08c85e6d431d9ba12bc2a093ad3fd392f1e6c_ppc64le |
| Red Hat | multicluster-engine/cluster-api-provider-azure-rhel8@sha256:84aaaea049c89f7269ef3222053023188c2d2b9007b3aa828ea2b265e2267ccd_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/cluster-api-provider-azure-rhel8@sha256:84aaaea049c89f7269ef3222053023188c2d2b9007b3aa828ea2b265e2267ccd_arm64 |
| Red Hat | multicluster-engine/managed-serviceaccount-rhel8@sha256:6e28423f90ce3ef852fec8d699ad80eb7e51ea36c4234629fd0e8c166903f8c3_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/managed-serviceaccount-rhel8@sha256:6e28423f90ce3ef852fec8d699ad80eb7e51ea36c4234629fd0e8c166903f8c3_arm64 |
| Red Hat | multicluster-engine/agent-service-rhel8@sha256:a132ae01bc7593e19b56511e81a38d88d380b104d08eabf84839e0a8e543533e_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | * |
| Red Hat | multicluster-engine/aws-encryption-provider-rhel8@sha256:1dd2af673814ac67a96673c96e3a7f108d82eae1111b544f50ee95c7ae1f67a7_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/aws-encryption-provider-rhel8@sha256:1dd2af673814ac67a96673c96e3a7f108d82eae1111b544f50ee95c7ae1f67a7_s390x |
| Red Hat | multicluster-engine/cluster-api-provider-aws-rhel8@sha256:00236e3fc911a90ef842c1269b7bfe3e9a352c9a9fe5c579e9df8b8654fbfd45_ppc64le as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/cluster-api-provider-aws-rhel8@sha256:00236e3fc911a90ef842c1269b7bfe3e9a352c9a9fe5c579e9df8b8654fbfd45_ppc64le |
| Red Hat | multicluster-engine/multicluster-engine-hypershift-addon-rhel8-operator@sha256:bd8e948a8e54504c26672f8b69ee1e8f9ec2dedf2d5fa12f03985676ae2d7d52_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | * |
| Red Hat | multicluster-engine/clusterlifecycle-state-metrics-rhel8@sha256:ab83e8fe74b0375561c49d7320c46bef42ba61b6575b4d26cd2963aedd72780f_arm64 as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | multicluster-engine/clusterlifecycle-state-metrics-rhel8@sha256:ab83e8fe74b0375561c49d7320c46bef42ba61b6575b4d26cd2963aedd72780f_arm64 |
| Red Hat | multicluster-engine/multicluster-engine-hypershift-deployment-controller-rhel8@sha256:59e52c6080b3b604bf93c5be57afbd4af5d077c4ba9ce5bf1c0d246756030ac4_s390x as a component of multicluster engine for Kubernetes 2.1 for RHEL 8 | * |
…and 133 more
Timeline
- Sep 12, 2022 CVE Published
- Jan 13, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2022:6424 advisory
- https://access.redhat.com/security/updates/classification/#critical advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2124794 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2125039 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6424.json advisory
- https://access.redhat.com/security/cve/CVE-2022-36067 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-36067 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-36067 advisory
- https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq advisory