PT-2021-13829 · Unknown · Openshift4/Ose-Docker-Builder

Jason Shepherd + 1 · Published 2021-02-23 · Updated 2021-05-21 · CVE-2021-20182

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: openshift4/ose-docker-builder (affected versions not specified)

Description: A privilege escalation flaw was found in the build container, which runs with high privileges using a chrooted environment instead of runc. If an attacker gains access to this build container, they can potentially utilize the raw devices of the underlying node, such as the network and storage devices, to escalate their privileges to that of the cluster admin. The highest threat from this issue is to data confidentiality and integrity as well as system availability.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2021-20182

Affected Products

Openshift4/Ose-Docker-Builder

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-20182 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20182 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1915110 · Vendor Advisory
• https://t.me/cvenotify/10386 · Telegram Post
• https://t.me/cibsecurity/24040 · Telegram Post
• https://t.me/cvenotify/10400 · Telegram Post