CVE-2024-45496 Openshift-controller-manager: elevated build pods can lead to node compromise in openshift
An attacker with developer access can execute arbitrary commands on worker nodes by exploiting privileged git-clone containers during build initialization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45496?
CVE-2024-45496 is a critical vulnerability in Red Hat OpenShift Container Platform 4.12, published on 16 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted .gitconfig file containing commands executed during the cloning process, leading to arbitrary command execution on the worker node. An attacker running code in a privileged container could escalate their permissions on the node running the container.
Weakness: CWE-269
Which versions are affected by CVE-2024-45496?
3 open source packages ship an affected version, including github.com/openshift/openshift-controller-manager.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openshift/openshift-controller-manager Go | All versions | None |
github.com/openshift/openshift-controller-manager Go | All versions | 0.0.0-alpha.0.0.20240911 |
github.com/openshift/openshift-controller-manager Go | All versions | 0.0.0-alpha.0.0.20240911 |
How do I fix CVE-2024-45496?
Upgrade github.com/openshift/openshift-controller-manager to 0.0.0-alpha.0.0.20240911 or later.
Is CVE-2024-45496 being exploited?
There is no known exploitation of CVE-2024-45496 in the wild and no public exploit code.
Sources
Also known as GHSA-j8gh-87rx-c7w9, GO-2024-3128.