A flaw was found in CRI-O's container-creation environment-variable handling

A flaw was found in CRI-O's container-creation environment-variable handling

(mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in

server/container_create.go). When a CreateContainer request supplies a nil CRI

Envs field, CRI-O falls back to using the target OCI image's config.Env entries

unfiltered, in contrast to the normal merge path, which validates each entry for a

key=value form before use. An OCI image whose config.Env contains an entry with no

= character (e.g. a bare NOEQUALS string) causes CRI-O to split that entry into a

single-element slice and then index its second element, which is out of range. This

triggers an unrecovered Go runtime panic in the crio daemon process, crashing it and

terminating the container-runtime service for all workloads on the node until it is

restarted.