Improper locking in Red Hat OpenShift Container Platform - CVE-2024-0793

Vulnerability identifier: #VU87652

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-0793

CWE-ID: CWE-667

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service attack (DoS).

The vulnerability exists due to improper locking when handling a malformed HPA v1 manifest in kube-controller-manager. A local user can perform a denial of service (DoS) attack.

Red Hat OpenShift Container Platform
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Containers Module
openSUSE Leap
IBM Cloud Pak for Security
QRadar Suite
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Watson AIOps
kubernetes1.23-client-debuginfo
kubernetes1.23-client
kubernetes1.23-client-common
kubernetes1.23-apiserver-debuginfo
kubernetes1.23-kubelet-debuginfo
kubernetes1.23-controller-manager-debuginfo
kubernetes1.23-scheduler-debuginfo
kubernetes1.23-kubeadm-debuginfo
kubernetes1.23-proxy-debuginfo
kubernetes1.23-client-bash-completion
kubernetes1.23-client-fish-completion
kubernetes1.23-kubelet-common
kubernetes1.23-controller-manager
kubernetes1.23-kubelet
kubernetes1.23-kubeadm
kubernetes1.23-scheduler
kubernetes1.23-proxy
kubernetes1.23-apiserver
kubernetes1.24-proxy
kubernetes1.24-kubeadm
kubernetes1.24-client-common
kubernetes1.24-kubelet-common
kubernetes1.24-scheduler
kubernetes1.24-client
kubernetes1.24-kubelet
kubernetes1.24-controller-manager
kubernetes1.24-apiserver
kubernetes1.24-client-fish-completion
kubernetes1.24-client-bash-completion
kubernetes1.25-kubelet-common
kubernetes1.25-client
kubernetes1.25-client-common
kubernetes1.25-apiserver
kubernetes1.25-proxy
kubernetes1.25-kubeadm
kubernetes1.25-scheduler
kubernetes1.25-controller-manager
kubernetes1.25-kubelet
kubernetes1.25-client-bash-completion
kubernetes1.25-client-fish-completion
kubernetes1.26-client-fish-completion
kubernetes1.26-client
kubernetes1.26-client-common
kubernetes1.26-client-bash-completion
kubernetes1.26-kubelet-common
kubernetes1.26-apiserver
kubernetes1.26-scheduler
kubernetes1.26-kubeadm
kubernetes1.26-kubelet
kubernetes1.26-controller-manager
kubernetes1.26-proxy
kata-containers (Red Hat package)
openshift (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)

Install updates from vendor's website.

Red Hat OpenShift Container Platform - addressed in versions 4.12.53, 4.11.59
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
kubernetes1.23-client-debuginfo - addressed in versions 1.23.17-150300.7.12.1, 1.23.17-150500.3.9.1
kubernetes1.23-client - addressed in versions 1.23.17-150300.7.12.1, 1.23.17-150500.3.9.1
kubernetes1.23-client-common - addressed in versions 1.23.17-150300.7.12.1, 1.23.17-150500.3.9.1
kubernetes1.23-apiserver-debuginfo - update to 1.23.17-150500.3.9.1
kubernetes1.23-kubelet-debuginfo - update to 1.23.17-150500.3.9.1
kubernetes1.23-controller-manager-debuginfo - update to 1.23.17-150500.3.9.1
kubernetes1.23-scheduler-debuginfo - update to 1.23.17-150500.3.9.1
kubernetes1.23-kubeadm-debuginfo - update to 1.23.17-150500.3.9.1
kubernetes1.23-proxy-debuginfo - update to 1.23.17-150500.3.9.1
kubernetes1.23-client-bash-completion - update to 1.23.17-150500.3.9.1
kubernetes1.23-client-fish-completion - update to 1.23.17-150500.3.9.1
kubernetes1.23-kubelet-common - update to 1.23.17-150500.3.9.1
kubernetes1.23-controller-manager - update to 1.23.17-150500.3.9.1
kubernetes1.23-kubelet - update to 1.23.17-150500.3.9.1
kubernetes1.23-kubeadm - update to 1.23.17-150500.3.9.1
kubernetes1.23-scheduler - update to 1.23.17-150500.3.9.1
kubernetes1.23-proxy - update to 1.23.17-150500.3.9.1
kubernetes1.23-apiserver - update to 1.23.17-150500.3.9.1
kubernetes1.24-proxy - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-kubeadm - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-client-common - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-kubelet-common - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-scheduler - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-client - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-kubelet - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-controller-manager - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-apiserver - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-client-fish-completion - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.24-client-bash-completion - addressed in versions 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1, 1.24.17-150500.3.13.1
kubernetes1.25-kubelet-common - update to 1.25.16-150400.9.6.1
kubernetes1.25-client - update to 1.25.16-150400.9.6.1
kubernetes1.25-client-common - update to 1.25.16-150400.9.6.1
kubernetes1.25-apiserver - update to 1.25.16-150400.9.6.1
kubernetes1.25-proxy - update to 1.25.16-150400.9.6.1
kubernetes1.25-kubeadm - update to 1.25.16-150400.9.6.1
kubernetes1.25-scheduler - update to 1.25.16-150400.9.6.1
kubernetes1.25-controller-manager - update to 1.25.16-150400.9.6.1
kubernetes1.25-kubelet - update to 1.25.16-150400.9.6.1
kubernetes1.25-client-bash-completion - update to 1.25.16-150400.9.6.1
kubernetes1.25-client-fish-completion - update to 1.25.16-150400.9.6.1
kubernetes1.26-client-fish-completion - update to 1.26.14-150400.9.6.1
kubernetes1.26-client - update to 1.26.14-150400.9.6.1
kubernetes1.26-client-common - update to 1.26.14-150400.9.6.1
kubernetes1.26-client-bash-completion - update to 1.26.14-150400.9.6.1
kubernetes1.26-kubelet-common - update to 1.26.14-150400.9.6.1
kubernetes1.26-apiserver - update to 1.26.14-150400.9.6.1
kubernetes1.26-scheduler - update to 1.26.14-150400.9.6.1
kubernetes1.26-kubeadm - update to 1.26.14-150400.9.6.1
kubernetes1.26-kubelet - update to 1.26.14-150400.9.6.1
kubernetes1.26-controller-manager - update to 1.26.14-150400.9.6.1
kubernetes1.26-proxy - update to 1.26.14-150400.9.6.1
kata-containers (Red Hat package) - update to 3.0.2-12.rhaos4.12.el8
IBM Cloud Pak for Watson AIOps - update to 4.8.1
openshift (Red Hat package) - addressed in versions 4.12.0-202403042037.p0.g9946c63.assembly.stream.el8, 4.12.0-202403042037.p0.g9946c63.assembly.stream.el9
kernel (Red Hat package) - update to 4.18.0-372.96.1.el8_6
kernel-rt (Red Hat package) - update to 4.18.0-372.96.1.rt7.256.el8_6

• https://access.redhat.com/errata/RHSA-2024:1267
• https://bugzilla.redhat.com/show_bug.cgi?id=2214402

• Denial of service in Red Hat OpenShift Container Platform
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.11
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.24
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Cloud Pak for Security and IBM QRadar Suite Software
• SUSE update for kubernetes1.23
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data