Bug 2500846 (CVE-2026-15809)

Summary:	CVE-2026-15809 github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rekumar, security-response-team, vvoronko
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2500979, 2500981, 2500984, 2500985, 2500986, 2500980, 2500982, 2500983
Bug Blocks:

Description OSIDB Bzimport 2026-07-15 10:07:51 UTC

The fix for CVE-2022-4318 in CRI-O is incorrect and has been bypassable since it was introduced on December 14, 2022. The check in server/container_create.go uses a Go raw string literal (`\n`) instead of an interpreted string literal ("\n"), causing it to search for the literal two-character sequence backslash-n (0x5c 0x6e) rather than an actual newline character (0x0a).

An attacker who can set environment variables on a container (via the CRI CreateContainer request) can supply a real newline character in the HOME environment variable, bypassing the check entirely. The unsanitized value is
then passed to utils.GeneratePasswd, which uses fmt.Sprintf to construct the container's /etc/passwd content, allowing arbitrary line injection.

Comment 4 errata-xmlrpc 2026-08-25 10:29:40 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.22

Via RHSA-2026:57361 https://access.redhat.com/errata/RHSA-2026:57361

Comment 5 errata-xmlrpc 2026-09-01 16:05:21 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.20

Via RHSA-2026:60444 https://access.redhat.com/errata/RHSA-2026:60444

Comment 6 errata-xmlrpc 2026-09-01 17:53:11 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.21

Via RHSA-2026:60449 https://access.redhat.com/errata/RHSA-2026:60449

Comment 7 errata-xmlrpc 2026-09-02 19:34:10 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2026:60452 https://access.redhat.com/errata/RHSA-2026:60452

Comment 8 errata-xmlrpc 2026-09-10 08:56:34 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2026:62548 https://access.redhat.com/errata/RHSA-2026:62548