CVE-2024-45496: OpenShift Elevated Build Pods Lead to Node Compromise

Key Information Vulnerability Description CVE Number: CVE-2024-45496 Vulnerability Name: openshift-controller-manager: Elevated Build Pods Can Lead to Node Compromise in OpenShift Description: A misconfiguration in the init container (git-clone) within OpenShift Container Platform that runs with privileged access. This allows an attacker with developer-level access to create a malicious .gitconfig file, which executes arbitrary commands during the cloning process, leading to privilege escalation within the workload. Impact Affected Component: openshift-controller-manager Affected Versions: Unknown Affected Platforms: All Affected Operating Systems: Linux Priority: High Severity: High Scope of Impact Affected Nodes: All nodes running the container Affected Workloads: All workloads running on affected nodes Degree of Impact Impact Level: Severe Impact Scope: All nodes and workloads Remediation Fixed Version: Unknown Remediation Status: Not Fixed Additional Information Report Date: August 30, 2024 Reporter: OSIDB Bzimport Status: New Priority: High Severity: High Target Milestone: Not Specified Assigned To: Product Security DevOps Team Documentation: Documentation Required Environment: Unknown Whiteboard: Unknown Dependencies: Unknown Blocks: Unknown Attachments: Detailed description of the vulnerability Summary This vulnerability allows an attacker with developer-level access to create a malicious .gitconfig file in OpenShift Container Platform, which executes arbitrary commands during the cloning process, resulting in privilege escalation within the workload. The impact is widespread, affecting all nodes running the container and all workloads on those nodes. The vulnerability remains unfixed and requires further documentation and remediation.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-45496: OpenShift Elevated Build Pods Lead to Node Compromise