CVE-2021-36779 Host operations allowed in privileged Longhorn managed pods
Attackers can execute arbitrary binaries on the host without authentication from any cluster workload, requiring an upgrade to secure the storage manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-36779?
CVE-2021-36779 is a critical missing authorization vulnerability in SUSE Longhorn, published on 17 Dec 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A Missing Authentication for Critical Function vulnerability in SUSE Longhorn allows any workload in the cluster to execute any binary present in the image on the host without authentication. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3.
Weakness: CWE-306
Which versions are affected by CVE-2021-36779?
It affects 1 product.
Products include Linuxfoundation Longhorn.
How do I fix CVE-2021-36779?
No fix has been published for CVE-2021-36779 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-36779 being exploited?
There is no known exploitation of CVE-2021-36779 in the wild and no public exploit code.