PT-2024-3765 · Unknown+2 · Cri-O Container Engine+2
Akihirosuda
+1
·
Published
2024-04-22
·
Updated
2024-09-12
·
CVE-2024-3154
CVSS v2.0
8.3
High
| Vector | AV:N/AC:L/Au:M/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
CRI-O Container Engine versions prior to the fixed version
Description
A flaw was found in CRI-O, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system. This can be achieved by adding annotations such as
org.systemd.property.SuccessAction to a Pod, allowing for the execution of arbitrary commands on the host system.Recommendations
For CRI-O Container Engine versions prior to the fixed version, consider implementing an external mutating webhook to disallow annotations with the prefix "org.systemd.property." to prevent exploitation.
Unfortunately, there is no information about a newer version that contains a fix for this vulnerability.
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Cri-O Container Engine
Red Os