diff --git a/other-cel/check-node-for-cve-2022-0185/artifacthub-pkg.yml b/other-cel/check-node-for-cve-2022-0185/artifacthub-pkg.yml new file mode 100644 index 000000000..7d4297f14 --- /dev/null +++ b/other-cel/check-node-for-cve-2022-0185/artifacthub-pkg.yml @@ -0,0 +1,22 @@ +name: check-node-for-cve-2022-0185 +version: 1.0.0 +displayName: Check Node for CVE-2022-0185 +createdAt: "2023-04-10T20:30:03.000Z" +description: >- + Linux CVE-2022-0185 can allow a container escape in Kubernetes if left unpatched. The affected Linux kernel versions, at this time, are 5.10.84-1 and 5.15.5-2. For more information, refer to https://security-tracker.debian.org/tracker/CVE-2022-0185. This policy runs in background mode and flags an entry in the ClusterPolicyReport if any Node is reporting one of the affected kernel versions. +install: |- + ```shell + kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/other/check-node-for-cve-2022-0185/check-node-for-cve-2022-0185.yaml + ``` +keywords: + - kyverno + - Other +readme: | + Linux CVE-2022-0185 can allow a container escape in Kubernetes if left unpatched. The affected Linux kernel versions, at this time, are 5.10.84-1 and 5.15.5-2. For more information, refer to https://security-tracker.debian.org/tracker/CVE-2022-0185. This policy runs in background mode and flags an entry in the ClusterPolicyReport if any Node is reporting one of the affected kernel versions. + + Refer to the documentation for more details on Kyverno annotations: https://artifacthub.io/docs/topics/annotations/kyverno/ +annotations: + kyverno/category: "Other" + kyverno/kubernetesVersion: "1.23" + kyverno/subject: "Node" +digest: ff64c6f2754226a75b84e88862af65ecc49ebad50cabd601687fd5770003f36a diff --git a/other-cel/check-node-for-cve-2022-0185/check-node-for-cve-2022-0185.yaml b/other-cel/check-node-for-cve-2022-0185/check-node-for-cve-2022-0185.yaml new file mode 100644 index 000000000..a0a287a5e --- /dev/null +++ b/other-cel/check-node-for-cve-2022-0185/check-node-for-cve-2022-0185.yaml @@ -0,0 +1,39 @@ +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: check-kernel + annotations: + policies.kyverno.io/title: Check Node for CVE-2022-0185 + policies.kyverno.io/category: Other + policies.kyverno.io/severity: high + kyverno.io/kyverno-version: 1.6.0 + policies.kyverno.io/minversion: 1.6.0 + kyverno.io/kubernetes-version: "1.23" + policies.kyverno.io/subject: Node + policies.kyverno.io/description: >- + Linux CVE-2022-0185 can allow a container escape in Kubernetes if left unpatched. + The affected Linux kernel versions, at this time, are 5.10.84-1 and 5.15.5-2. + For more information, refer to https://security-tracker.debian.org/tracker/CVE-2022-0185. + This policy runs in background mode and flags an entry in the ClusterPolicyReport + if any Node is reporting one of the affected kernel versions. +spec: + validationFailureAction: audit + background: true + rules: + - name: kernel-validate + match: + any: + - resources: + kinds: + - Node + validate: + message: "Kernel is vulnerable to CVE-2022-0185." + deny: + conditions: + any: + - key: "{{request.object.status.nodeInfo.kernelVersion}}" + operator: Equals + value: "5.10.84-1" + - key: "{{request.object.status.nodeInfo.kernelVersion}}" + operator: Equals + value: "5.15.5-2" \ No newline at end of file