Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15

Published: 2024-03-01 | Updated: 2024-04-19

Risk	High
Patch available	YES
Number of vulnerabilities	9
CVE-ID	CVE-2023-44487 CVE-2023-39325 CVE-2023-39326 CVE-2023-45287 CVE-2023-48795 CVE-2023-40225 CVE-2023-47108 CVE-2023-6476 CVE-2024-21626
CWE-ID	CWE-400 CWE-203 CWE-326 CWE-444 CWE-264 CWE-254
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Public exploit code for vulnerability #9 is available.
Vulnerable software Subscribe	Red Hat OpenShift Container Platform Client/Desktop applications / Software for system administration toolbox (Red Hat package) Operating systems & Components / Operating system package or component skopeo (Red Hat package) Operating systems & Components / Operating system package or component rust-bootupd (Red Hat package) Operating systems & Components / Operating system package or component rust-afterburn (Red Hat package) Operating systems & Components / Operating system package or component runc (Red Hat package) Operating systems & Components / Operating system package or component rpm-ostree (Red Hat package) Operating systems & Components / Operating system package or component podman (Red Hat package) Operating systems & Components / Operating system package or component ostree (Red Hat package) Operating systems & Components / Operating system package or component ose-aws-ecr-image-credential-provider (Red Hat package) Operating systems & Components / Operating system package or component openshift-clients (Red Hat package) Operating systems & Components / Operating system package or component openshift-ansible (Red Hat package) Operating systems & Components / Operating system package or component openshift (Red Hat package) Operating systems & Components / Operating system package or component ignition (Red Hat package) Operating systems & Components / Operating system package or component crun (Red Hat package) Operating systems & Components / Operating system package or component cri-tools (Red Hat package) Operating systems & Components / Operating system package or component cri-o (Red Hat package) Operating systems & Components / Operating system package or component coreos-installer (Red Hat package) Operating systems & Components / Operating system package or component container-selinux (Red Hat package) Operating systems & Components / Operating system package or component conmon (Red Hat package) Operating systems & Components / Operating system package or component buildah (Red Hat package) Operating systems & Components / Operating system package or component kernel-rt (Red Hat package) Operating systems & Components / Operating system package or component kernel (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Resource exhaustion

EUVDB-ID: #VU81728

Risk: High

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C]

CVE-ID: CVE-2023-44487

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Resource exhaustion

EUVDB-ID: #VU82064

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-39325

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to excessive consumption of internal resources when handling HTTP/2 requests. A remote attacker can bypass the http2.Server.MaxConcurrentStreams setting by creating new connections while the current connections are still being processed, trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource exhaustion

EUVDB-ID: #VU83928

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-39326

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling HTTP chunked requests. A remote attacker can send specially crafted HTTP requests to the server and consume excessive memory resources.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Observable discrepancy

EUVDB-ID: #VU86309

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-45287

CWE-ID: CWE-203 - Observable discrepancy

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a timing discrepancy when handling RSA based TLS key exchanges. A remote attacker can perform a Marvin attack and gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Inadequate encryption strength

EUVDB-ID: #VU84537

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48795

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.

The vulnerability was dubbed "Terrapin attack" and it affects both client and server implementations.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU79767

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-40225

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request with empty Content-Length headers to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Resource exhaustion

EUVDB-ID: #VU84507

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-47108

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to grpc Unary Server Interceptor does not properly control consumption of internal resources when processing multiple requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU85580

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6476

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to unchecked access to an experimental annotation. A remote user can use the cgroupv2 and perform a denial of service (DoS) attack by consuming all available memory resources.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Security features bypass

EUVDB-ID: #VU85991

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2024-21626

CWE-ID: CWE-254 - Security Features

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an internal file descriptor leak that can cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace or a malicious image to allow a container process to gain access to the host filesystem through runc run. A remote attacker can trick the victim into loading a malicious image to bypass sandbox restrictions and execute arbitrary code on the host OS.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: before 4.15.0

toolbox (Red Hat package): before 0.1.2-1.rhaos4.15.el9

skopeo (Red Hat package): before 1.11.2-21.1.rhaos4.15.el9

rust-bootupd (Red Hat package): before 0.2.17-1.el9

rust-afterburn (Red Hat package): before 5.4.3-2.rhaos4.15.el9

runc (Red Hat package): before 1.1.12-1.rhaos4.15.el9

rpm-ostree (Red Hat package): before 2024.2-1.el9

podman (Red Hat package): before 4.4.1-21.rhaos4.15.el9

ostree (Red Hat package): before 2023.8-3.el9

ose-aws-ecr-image-credential-provider (Red Hat package): before 4.15.0-202401231232.p0.gba252ab.assembly.stream.el9

openshift-clients (Red Hat package): before 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el9

openshift-ansible (Red Hat package): before 4.15.0-202402162207.p0.g1c9b99e.assembly.stream.el9

openshift (Red Hat package): before 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el9

ignition (Red Hat package): before 2.16.2-2.rhaos4.15.el9

crun (Red Hat package): before 1.14-1.rhaos4.15.el9

cri-tools (Red Hat package): before 1.28.0-3.el9

cri-o (Red Hat package): before 1.28.3-14.rhaos4.15.git33aabd8.el9

coreos-installer (Red Hat package): before 0.17.0-3.rhaos4.15.el9

container-selinux (Red Hat package): before 2.228.1-1.rhaos4.15.el9

conmon (Red Hat package): before 2.1.7-1.2.rhaos4.14.el9

buildah (Red Hat package): before 1.29.1-20.2.rhaos4.15.el9

kernel-rt (Red Hat package): before 5.14.0-284.54.1.rt14.339.el9_2

kernel (Red Hat package): before 5.14.0-284.54.1.el9_2

External links

http://access.redhat.com/errata/RHSA-2023:7201

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.