Description
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
Problem types
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Product status
1.27.5 (semver)
1.27.6 (semver)
1.28.5 (semver)
1.28.6 (semver)
1.29.3 (semver)
1.29.4 (semver)
1.30.0 (semver)
0:1.25.5-16.2.rhaos4.12.gitcb09013.el8 (rpm) before *
0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9 (rpm) before *
0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9 (rpm) before *
0:1.28.6-2.rhaos4.15.git77bbb1c.el8 (rpm) before *
Timeline
| 2024-04-01: | Reported to Red Hat. |
| 2024-04-22: | Made public. |
Credits
Red Hat would like to thank Akihiro Suda and Cédric Clerget for reporting this issue. Upstream acknowledges the CRI-O team as the original reporter.
References
access.redhat.com/errata/RHSA-2024:2669 (RHSA-2024:2669)
access.redhat.com/errata/RHSA-2024:2672 (RHSA-2024:2672)
access.redhat.com/errata/RHSA-2024:2784 (RHSA-2024:2784)
access.redhat.com/errata/RHSA-2024:3496 (RHSA-2024:3496)
access.redhat.com/security/cve/CVE-2024-3154
bugzilla.redhat.com/show_bug.cgi?id=2272532 (RHBZ#2272532)
github.com/.../cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
github.com/opencontainers/runc/pull/4217
github.com/opencontainers/runtime-spec/blob/main/features.md
access.redhat.com/errata/RHSA-2024:2669 (RHSA-2024:2669)
access.redhat.com/errata/RHSA-2024:2672 (RHSA-2024:2672)
access.redhat.com/errata/RHSA-2024:2784 (RHSA-2024:2784)
access.redhat.com/errata/RHSA-2024:3496 (RHSA-2024:3496)
access.redhat.com/security/cve/CVE-2024-3154
bugzilla.redhat.com/show_bug.cgi?id=2272532 (RHBZ#2272532)
github.com/.../cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
github.com/opencontainers/runc/pull/4217
github.com/opencontainers/runtime-spec/blob/main/features.md