CyberRota Analysis
AI-GeneratedThe vulnerability affects the CRI-O container runtime, specifically in its handling of environment variables during container creation. When a `CreateContainer` request includes a `nil` `Envs` field, CRI-O improperly processes unfiltered environment entries from the OCI image, leading to a runtime panic and crash of the `crio` daemon. Organizations utilizing CRI-O for container orchestration should prioritize addressing this flaw to prevent service disruptions across their workloads.
Original NVD Description
A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.