CVE-2024-3154
Cri-o: arbitrary command injection via pod annotation
HIGH 7.2
At a glance
- Source
- NVD
- EPSS
- EPSS 1.42 % · percentile 73 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
Weaknesses (CWE)
- CWE-77 — Command Injection
References
- https://access.redhat.com/errata/RHSA-2024:2669
- https://access.redhat.com/errata/RHSA-2024:2672
- https://access.redhat.com/errata/RHSA-2024:2784
- https://access.redhat.com/errata/RHSA-2024:3496
- https://access.redhat.com/security/cve/CVE-2024-3154
- https://bugzilla.redhat.com/show_bug.cgi?id=2272532
- https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
- https://github.com/opencontainers/runc/pull/4217
- https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
Advisories
- GHSA-2cgq-h8xw-2v5j — CRI-O vulnerable to an arbitrary systemd property injection
- GO-2024-2791 — CRI-O vulnerable to an arbitrary systemd property injection in github.com/cri-o/cri-o
European references
- ENISA EUVD · EUVD-2024-1060
- GCVE · GCVE-0-2024-3154
CERT-FR advisories
- CERTFR-2026-AVI-0249 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0841 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| cri-o | affected 1.27.5 ; unaffected 1.27.6 ; affected 1.28.5 ; unaffected 1.28.6 ; affected 1.29.3 ; unaffected 1.29.4 |
| Red Hat · Red Hat OpenShift Container Platform 4.12 | unaffected 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.13 | unaffected 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.15 | unaffected 0:1.28.6-2.rhaos4.15.git77bbb1c.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 3.11 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |