cri-o: fix CVE-2023-6476kirkstone

A flaw was found in CRI-O that involves an experimental annotation leading to a
container being unconfined. This may allow a pod to specify and get any amount
of memory/cpu, circumventing the kubernetes scheduler and potentially resulting
in a denial of service in the node.

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/recipes-containers/cri-o/cri-o_git.bb b/recipes-containers/cri-o/cri-o_git.bb
index 429c49a7..1e8353f8 100644
--- a/recipes-containers/cri-o/cri-o_git.bb
+++ b/recipes-containers/cri-o/cri-o_git.bb
@@ -20,6 +20,7 @@ SRC_URI = "\
         file://0001-Makefile-force-symlinks.patch \
         file://crio.conf \
         file://0001-Use-securejoin.SecureJoin-when-forming-userns-paths.patch;patchdir=src/import/vendor/github.com/containers/storage \
+        file://CVE-2023-6476.patch;patchdir=src/import \
         "
 
 # Apache-2.0 for docker