Container escape flaw fixed in CRI-O runtime engine

The original write-up is linked from this post https://www.crowdstrike.com/blog/cr8escape-new-vulnerability... - Good, lots of details on exact reproduction.

One idea for mitigation before you can get a patch out for this would be to use admission control (e.g. OPA/Kyverno) to block setting custom sysctls altogether or blocking the characters used in the attack. There's some notes on that https://blog.aquasec.com/cve-2022-0811-cri-o-vulnerability and Kyverno have a mention of the finer grained policy https://twitter.com/kyverno/status/1504499323324678145

One thing that's worth noting is that to exploit this the attacker needs create pod rights (or rights to create a workload type that then creates pods), so it's probably not critical for every cluster.

Would Podman rootless prevent such exploits? You could run each pod under a separate user that has no access to important files.