BMO can expose particularly named secrets from other namespaces via BMH CRD
CVE: CVE-2024-43803
Component: Bare Metal Operator
CWE: CWE-653
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2024-09-03T19:15:14.800000+00:00

A flaw was found in the Bare Metal Operator (BMO). The BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost (BMH) CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for the Name and Namespace of the Secret, meaning that the baremetal-operator will read a Secret from any namespace. This flaw allows a user with access to create or edit a BareMetalHost can exfiltrate a Secret from another namespace by using it as the userData for provisioning some host, for example. Note that this need not be a real host; it could be a random VM.

Statement: This issue is considered moderate rather than important because it requires specific conditions to be exploited. The vulnerability relies on an attacker already having the ability to create or modify a BareMetalHost resource, which typically requires elevated permissions. Furthermore, the flaw only allows exfiltration of Secrets by referencing them in another namespace, but does not directly expose or escalate privileges across the cluster. It also doesn't impact the integrity or availability of the system but is limited to confidentiality concerns within a specific scope. Proper RBAC policies can mitigate this risk, reducing its overall severity.

Remediation:
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:0521a0f1acd2d1b77f76259cb9bae9c743c60c37d9903806a3372c1414253658

      (For s390x architecture)
      The image digest is sha256:10935ec4eff66bc610801300a4376e6d733631e93681ef1dae5f0962fec98681

      (For ppc64le architecture)
      The image digest is sha256:dbf7aec1bd0a24fd5a23d6ac927d101b7e0cfcb8d4ccb8c440b2ed17a0dd9705

      (For aarch64 architecture)
      The image digest is sha256:76eb80594e33fc9300a0f36e4402e5232681eddf948b995a8d1acfd2fc7d72f9

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
The Operator can configure BMO RBAC to be the namespace scoped for Secrets, instead of the cluster scoped to prevent BMO from accessing Secrets from other namespaces.