CVE-2022-38060 OpenStack Kolla sudo privilege escalation vulnerability
A misconfiguration in OpenStack Kolla containers allows attackers to escalate privileges via sudo.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-38060?
CVE-2022-38060 is a high-severity vulnerability in OpenStack, published on 21 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
Which versions are affected by CVE-2022-38060?
3 open source packages ship an affected version, including kolla. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kolla PyPI | All versions | 15.0.0.0rc1 |
kolla PyPI | All versions | 15.0.0.0rc1 |
kolla PyPI | All versions | 15.0.0.0rc1 |
Linux distribution packages (9)
openstack-tripleo-common Red Hat:openstack:17.1::el8 | All versions | 0:15.4.1-17.1.20230927003755.el8ost |
openstack-tripleo-common-container-base Red Hat:openstack:17.1::el8 | All versions | 0:15.4.1-17.1.20230927003755.el8ost |
openstack-tripleo-common-containers Red Hat:openstack:17.1::el8 | All versions | 0:15.4.1-17.1.20230927003755.el8ost |
python3-tripleo-common Red Hat:openstack:17.1::el8 | All versions | 0:15.4.1-17.1.20230927003755.el8ost |
openstack-tripleo-common Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20230927010819.el9ost |
openstack-tripleo-common-container-base Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20230927010819.el9ost |
openstack-tripleo-common-containers Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20230927010819.el9ost |
openstack-tripleo-common-devtools Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20230927010819.el9ost |
python3-tripleo-common Red Hat:openstack:17.1::el9 | All versions | 0:15.4.1-17.1.20230927010819.el9ost |
Products include Openstack Kolla.
How do I fix CVE-2022-38060?
Upgrade kolla to 15.0.0.0rc1 or later.
Is CVE-2022-38060 being exploited?
There is no known exploitation of CVE-2022-38060 in the wild and no public exploit code.
Sources
Also known as GHSA-rvxr-pf5f-j2qj, PYSEC-2026-838, RHSA-2024:0191, RHSA-2024:0216.