Elevated Build Pods Can Lead to Node Compromise in OpenShift
CVE: CVE-2024-45496
Component: openshift-controller-manager
CWE: CWE-269
Severity: Important
CVSS v3: 9.5/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Release date: 2024-09-16T07:55:00+00:00

A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted .gitconfig file containing commands executed during the cloning process, leading to arbitrary command execution on the worker node. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Statement: In all versions of OpenShift, the "Custom" build strategy gives developers permission to run arbitrary commands in a privileged container. This is disabled by default, and documentation explicitly warns that this should only be enabled for highly trusted users (eg: cluster admins). We therefore do not consider this vulnerability a privilege escalation path for "Custom" strategy builds.

Microshift is not affected by this vulnerability. MicroShift does not include this OpenShift API.

The Builds for Red Hat OpenShift Operator based on Shipwright is not affected by this vulnerability.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:1c522e4dd313e4e40af620bd08bef1f3d5518024d32107fa560617795ec0fadd

      (For s390x architecture)
      The image digest is sha256:0623cfc814cfe42740de33083f6dd739a88be6b4d6f2bddaedcf8fb8bca0d47e

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are:

      (For x86_64 architecture)
      The image digest is sha256:6afb11e1cac46fd26476ca134072937115256b9c6360f7a1cd1812992c065f02

      (For s390x architecture)
      The image digest is sha256:1bdaf80b51a47cd545a4aa2c7282ab2093574fbee2f770acf10a19de7ca5daea

      (For ppc64le architecture)
      The image digest is sha256:9033dfb9cdc34eb73d50dfa4d5f329061ab232238a04993fb2baf19e42b7073a

      (For aarch64 architecture)
      The image digest is sha256:fda846b80f2dc96941f157c9db383a37d87b4f4cfcb9e9dd2fcd29972b239200

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:14e6ba3975e6c73b659fa55af25084b20ab38a543772ca70e184b903db73092b

      (For s390x architecture)
      The image digest is sha256:46442c04cb44a30b0de3bcfbd528eb2ee951bde4997d293f0dc2254e9d80c08a

      (For ppc64le architecture)
      The image digest is sha256:bfce075584c08b174fce03aec8fbc25ee651891f941102f9e94294b0cd689502

      (For aarch64 architecture)
      The image digest is sha256:ea16a3d17df211406420d897068cd14d18347bf26321393fb2f7a57bbc9dcf0e

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are:

      (For x86_64 architecture)
      The image digest is sha256:f5bbc3d132a60943b52b4d4c2a34da7f631d5989b27525017c61a45bee61bed2

      (For s390x architecture)
      The image digest is sha256:f055d62ce22de287dd696f1730591d4baab3670a3f4cb717844e3a7699a2cbde

      (For ppc64le architecture)
      The image digest is sha256:6defb7eea8dfed1f316e5cee2a8ab2f8136faa7e43257130d021c3573349529d

      (For aarch64 architecture)
      The image digest is sha256:3c4c6adf1696633f8bc93a4e1faef8507e66229037673227edd221a879f84bee

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:6078cb4ae197b5b0c526910363b8aff540343bfac62ecb1ead9e068d541da27b

      (For s390x architecture)
      The image digest is sha256:5b286b07b5267aa96af112f6420444d91c529456b7dc7e15d49ab4ef89ca9713

      (For ppc64le architecture)
      The image digest is sha256:6c6b61c7890d49346e653b117c46f74171b2a65ce18edf11afa331e115ff392d

      (For aarch64 architecture)
      The image digest is sha256:9d2928127d6a440a8931b4a0c6f565cb490338804e920f4493fb7ce875884baa

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:fbad931c725b2e5b937b295b58345334322bdabb0b67da1c800a53686d7397da

      (For s390x architecture)
      The image digest is sha256:9054f1987c9a0128374f2e7fa91a0b9d074d9665ef48758e6f29a89c14edd8f6

      (For ppc64le architecture)
      The image digest is sha256:8a457e302eb66d06d17cb5cba491077b92a623217e05d486740969974b2aaef8

      (For aarch64 architecture)
      The image digest is sha256:c9c31f9120f1049b88b282be4589d1da504ee436dfa51487349d08fecd29dd1e

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html
Cluster admins can follow the instructions in "Securing Builds by Strategy" to block use of the "Docker" and “Source” build strategies on a cluster, or restrict the use to a set of highly trusted users, until the cluster is able to be upgraded.

https://docs.openshift.com/container-platform/4.16/cicd/builds/securing-builds-by-strategy.html