Skip to content
OpenAdvisories
Low · 2.7 Public exploit CVE-2024-3177 EUVD-2024-1273GHSA-pxhw-596r-rwq5GO-2024-2746

Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin

Published Apr 22, 2024 · Updated Sep 10, 2024 · Assigned by kubernetes

Vendor: Kubernetes Product: Kubernetes Package: argocd-image-updater Package: aws-efs-csi-driver Package: ip-masq-agent Package: k8s.io/kubernetes Package: kubectl-1.28 Package: kubectl-1.28-default Package: kubectl-bash-completion-1.28 Package: kubeflow-pipelines-apiserver Package: kubernetes Package: kubernetes Package: kubernetes-csi-driver-hostpath Package: kubernetes-dns-node-cache Package: local-static-provisioner Package: nodetaint Package: spark-operator Package: spark-operator-oci-entrypoint Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Wolfi

Description

A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.

Affected products

VendorProductAffectedFixed
Kubernetes Kubernetes ≤ 1.27.12, v1.28.0 - v1.28.8, v1.29.0 - v1.29.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 kubernetes 1.20.5+really1.20.2-1 —
Debian 13 kubernetes 1.20.5+really1.20.2-1 —
Debian 12 kubernetes 1.20.5+really1.20.2-1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 4 microshift +8 4.16.0-202406260523.p0.gc5a37df.assembly.4.16.0.el9 RHSA-2024:0043
Red Hat OpenShift 4 openshift +1 4.14.0-202404231437.p0.g401bb48.assembly.stream.el8 RHSA-2024:2054
Red Hat OpenShift 4 skopeo +1 2:1.11.3-0.1.rhaos4.14.el8 RHSA-2024:2054

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 kubernetes1.23 1.23.17-150500.3.12.1 SUSE-SU-2024:1404-1
SLES 15 SP5 kubernetes1.24 1.24.17-150500.3.16.1 SUSE-SU-2024:1403-1
SLES 15 SP4 kubernetes1.23 1.23.17-150300.7.12.1 SUSE-SU-2025:02423-2
SLES 15 SP4 kubernetes1.24 1.24.17-150400.9.16.1 SUSE-SU-2024:3341-1
SLES 15 SP3 kubernetes1.23 1.23.17-150300.7.12.1 SUSE-SU-2025:02423-2
SLES 15 SP3 kubernetes1.24 1.24.17-150300.7.6.1 SUSE-SU-2024:3343-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 kubernetes1.23 1.23.17-150300.7.12.1 SUSE-SU-2025:02423-2
SLES for SAP 15 SP4 kubernetes1.24 1.24.17-150400.9.16.1 SUSE-SU-2024:3341-1
SLES for SAP 15 SP3 kubernetes1.23 1.23.17-150300.7.12.1 SUSE-SU-2025:02423-2
SLES for SAP 15 SP3 kubernetes1.24 1.24.17-150300.7.6.1 SUSE-SU-2024:3343-1
SLE HPC 15 SP4 kubernetes1.23 1.23.17-150300.7.12.1 SUSE-SU-2025:02423-2
SLE HPC 15 SP4 kubernetes1.24 1.24.17-150400.9.16.1 SUSE-SU-2024:3341-1
SLE HPC 15 SP3 kubernetes1.23 1.23.17-150300.7.12.1 SUSE-SU-2025:02423-2
SLE HPC 15 SP3 kubernetes1.24 1.24.17-150300.7.6.1 SUSE-SU-2024:3343-1
SUSE Enterprise Storage 7.1 kubernetes1.23 1.23.17-150300.7.12.1 SUSE-SU-2025:02423-2
SUSE Enterprise Storage 7.1 kubernetes1.24 1.24.17-150300.7.6.1 SUSE-SU-2024:3343-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 kubernetes1.23 1.23.17-150500.3.12.1 SUSE-SU-2024:1404-1
openSUSE Leap 15.5 kubernetes1.24 1.24.17-150500.3.16.1 SUSE-SU-2024:1403-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kubernetes 1.30.1-1 —
Azure Linux 2 (CBL-Mariner) kubernetes No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling argocd-image-updater 0.17.0-r1 —
Wolfi rolling aws-efs-csi-driver 2.1.1-r0 —
Wolfi rolling ip-masq-agent 2.9.3-r10 —
Wolfi rolling kubectl-1.28 +2 1.28.9-r0 —
Wolfi rolling kubeflow-pipelines-apiserver 2.14.3-r3 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.13.0-r3 —
Wolfi rolling kubernetes-dns-node-cache 1.23.0-r5 —
Wolfi rolling local-static-provisioner 2.7.0-r1 —
Wolfi rolling nodetaint 0.0.4-r16 —
Wolfi rolling spark-operator +1 1.2.12-r1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Cgv-Dev/Metasploit-Module-TFM ★ 0 · Sep 5, 2024

    Module written in Ruby with the objective of exploiting vulnerabilities CVE-2023-2728 and CVE-2024-3177, both related to the secret mount policy in a Kubernetes cluster using a custom Metasploit modu…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go k8s.io/kubernetes < 1.27.13 1.27.13 GHSA-pxhw-596r-rwq5
Go k8s.io/kubernetes >= 1.29.0, < 1.29.4 1.29.4 GHSA-pxhw-596r-rwq5
Go k8s.io/kubernetes >= 1.28.0, < 1.28.9 1.28.9 GHSA-pxhw-596r-rwq5
Go k8s.io/kubernetes < 1.27.13 · >= 1.28.0, < 1.28.9 · >= 1.29.0, < 1.29.4 1.27.13, 1.28.9, 1.29.4 GO-2024-2746

Advisories 9

References