Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.7

Published: 2021-07-26 | Updated: 2022-08-09

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2021-33909 CVE-2021-33910
CWE-ID	CWE-190 CWE-789
Exploitation vector	Local
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	openshift-kuryr (Red Hat package) Operating systems & Components / Operating system package or component openshift-clients (Red Hat package) Operating systems & Components / Operating system package or component cri-o (Red Hat package) Operating systems & Components / Operating system package or component openshift (Red Hat package) Operating systems & Components / Operating system package or component openshift-ansible (Red Hat package) Operating systems & Components / Operating system package or component atomic-openshift-service-idler (Red Hat package) Operating systems & Components / Operating system package or component kernel-rt (Red Hat package) Operating systems & Components / Operating system package or component kernel (Red Hat package) Operating systems & Components / Operating system package or component Red Hat OpenShift Container Platform Client/Desktop applications / Software for system administration
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Integer overflow

EUVDB-ID: #VU55143

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-33909

CWE-ID: CWE-190 - Integer overflow

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow during size_t-to-int conversion when creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB. An unprivileged local user can write up to 10-byte string to an offset of exactly -2GB-10B below the beginning of a vmalloc()ated kernel buffer.

Successful exploitation of vulnerability may allow an attacker to exploit the our-of-bounds write vulnerability to execute arbitrary code with root privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

openshift-kuryr (Red Hat package): 4.7.0-202103171728.p0.git.2502.8383c08.el8 - 4.7.0-202106232224.p0.git.c7654fb.el8

openshift-clients (Red Hat package): 4.7.0-202103191426.p0.git.3953.f3a7513.el7 - 4.7.0-202106252127.p0.git.8b4b094.el8

cri-o (Red Hat package): 1.20.2-3.rhaos4.7.gitfecc319.el7 - 1.20.3-6.rhaos4.7.git0d0f863.el8

openshift (Red Hat package): 4.7.0-202103181538.p0.git.97109.7576cdc.el7 - 4.7.0-202105160013.p0.git.df9c838.el8

openshift-ansible (Red Hat package): 4.7.0-202103181433.p0.git.0.729df27.el7 - 4.7.0-202105111743.p0.git.e1b19c2.el7

atomic-openshift-service-idler (Red Hat package): 4.7.0-202104260636.p0.git.330c6ef.el8 - 4.7.0-202105111743.p0.git.39cfc66.el8

kernel-rt (Red Hat package): 4.18.0-240.10.1.rt7.64.el8_3 - 4.18.0-240.22.1.rt7.77.el8_3

kernel (Red Hat package): 4.18.0-240.10.1.el8_3 - 4.18.0-240.22.1.el8_3

Red Hat OpenShift Container Platform: before 4.7.21

External links

http://access.redhat.com/errata/RHSA-2021:2763

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Uncontrolled Memory Allocation

EUVDB-ID: #VU55034

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-33910

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

Exploit availability: Yes

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to stack exhaustion within the basic/unit-name.c in systemd. A local user can crash the systemd (PID 1) and cause a kernel panic.