Description
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cri-o | 1.27.5, 1.28.5, 1.29.3 | 1.27.6 |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 3.11 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.25.5-16.2.rhaos4.12.gitcb09013.el8 | RHSA-2024:3496, RHSA-2024:2784, RHSA-2024:2672 |
| Red Hat OpenShift 4 | openshift +1 | 4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8 | RHSA-2024:2672 |
| Red Hat OpenShift 4 | podman +6 | 3:4.4.1-3.2.rhaos4.12.el8 | RHSA-2024:2784, RHSA-2024:2672, RHSA-2024:2669 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.9.4-4.3.rhaos4.12.el8 | RHSA-2024:2784 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grype | 0.80.1-1.1 | openSUSE-SU-2024:14334-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | cri-o | 1.22.3-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | buildah | 1.35.3-r1 | — |
| Wolfi rolling | cadvisor +1 | 0.52.1-r3 | — |
| Wolfi rolling | ctop | 0.7.7-r23 | — |
| Wolfi rolling | grype | 0.90.0-r1 | — |
| Wolfi rolling | kubectl-1.27 +5 | No fix yet | — |
| Wolfi rolling | kubectl-1.28 +2 | 1.28.15-r11 | — |
| Wolfi rolling | neuvector-scanner +2 | 0_git20240528-r10 | — |
| Wolfi rolling | opentelemetry-collector-contrib +1 | 0.122.0-r1 | — |
| Wolfi rolling | wolfictl | 0.16.6-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cri-o/cri-o | >= 1.29.0, < 1.29.4 | 1.29.4 | GHSA-2cgq-h8xw-2v5j |
| Go | github.com/cri-o/cri-o | >= 1.28.0, < 1.28.6 | 1.28.6 | GHSA-2cgq-h8xw-2v5j |
| Go | github.com/cri-o/cri-o | < 1.27.6 | 1.27.6 | GHSA-2cgq-h8xw-2v5j |
| Go | github.com/cri-o/cri-o | < 1.27.6 · >= 1.28.0, < 1.28.6 · >= 1.29.0, < 1.29.4 | 1.27.6, 1.28.6, 1.29.4 | GO-2024-2791 |
Advisories 6
- RHSA-2024:2784 Red Hat Security Advisory: OpenShift Container Platform 4.12.57 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2672 Red Hat Security Advisory: OpenShift Container Platform 4.14.24 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:2669 Red Hat Security Advisory: OpenShift Container Platform 4.15.12 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:3496 Red Hat Security Advisory: OpenShift Container Platform 4.13.43 security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- openSUSE-SU-2024:14334-1 grype-0.80.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1297 Red Hat OpenShift: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jun 5, 2024
References
- RHSA-2024:2669 vendor-advisory
- RHSA-2024:2672 vendor-advisory
- RHSA-2024:2784 vendor-advisory
- RHSA-2024:3496 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-3154 vdb-entry
- RHBZ#2272532 issue-tracking
- https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
- https://github.com/opencontainers/runc/pull/4217
- https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson