Description (CNA)
A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 before 1.34.11; affected 0 before 1.35.7; affected 0 before 1.36.3 |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
| Red Hat / Red Hat OpenShift Container Platform 4 | affected |
CWE
CWE-1287
References
- https://access.redhat.com/security/cve/CVE-2026-17113
- https://bugzilla.redhat.com/show_bug.cgi?id=2506872
ADP enrichment
No English description supplied.
No references supplied.