CVE-2024-33522
Assigner: Tigera
Published: 2024-04-29T22:19:06.908Z
State: PUBLISHED
affected: defaultStatus: unaffected
packageName: cni-plugin
product: Calico
repo: https://www.tigera.io/tigera-products/calico/
vendor: Tigera
versions: lessThan: v3.26.5
status: affected
version: 0
versionType: semver
lessThan: v3.27.3
status: affected
version: v3.27.0
versionType: semver
status: unaffected
version: v3.28.0
defaultStatus: unaffected
packageName: cni-plugin
product: Calico Enterprise 
vendor: Tigera
versions: lessThan: v3.17.4
status: affected
version: 0
versionType: semver
lessThan: v3.18.2
status: affected
version: v3.18.0
versionType: semver
lessThan: v3.19.0-2.0
status: affected
version: v3.19.0-1.0
versionType: semver
defaultStatus: unaffected
packageName: cni-plugin
product: Calico Cloud
vendor: Tigera
versions: lessThan: v19.3.0
status: affected
version: 0
versionType: semver
credits: type: finder
value: Christopher Alonso (Github: @latortuga71)
type: remediation reviewer
value: Anthony Tam
type: remediation verifier
value: Behnam Shobiri
type: remediation developer
value: Pedro Coutinho
type: remediation reviewer
value: Matt Dupre
datePublic: 2024-04-29T19:57:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: transparent;">In vulnerable </span><span style="background-color: transparent;">versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. The issue arises from an incorrect SUID (Set User ID) bit configuration in the binary, combined with the ability to control the input binary, allowing an attacker to execute an arbitrary binary with elevated privileges.</span><br>
value: In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulnerability in the Calico CNI install binary. The issue arises from an incorrect SUID (Set User ID) bit configuration in the binary, combined with the ability to control the input binary, allowing an attacker to execute an arbitrary binary with elevated privileges.

impacts: capecId: CAPEC-233
descriptions: value: CAPEC-233 Privilege Escalation
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-269
description: CWE-269 Improper Privilege Management
type: CWE
source: discovery: UNKNOWN
title: Privilege escalation in Calico CNI install binary
x_generator: engine: Vulnogram 0.1.0-dev