CVE-2024-3154

🗓️ 26 Apr 2024 03:12:38Reported by MendType

Arbitrary systemd property injection in cri-o via Pod annotation allows host actions.

Reporter	Title	Published	Views	Family All 120
IBM Security Bulletins	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	15 Apr 202503:06	–	ibm
IBM Security Bulletins	Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a cri-o security vulnerability (CVE-2024-3154)	4 Jul 202411:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	4 Mar 202615:08	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in CRI-O affects watsonx.data	14 Aug 202415:42	–	ibm
BDU FSTEC	The vulnerability of the CRI-O Container Engine’s application programming interface, a software platform for managing clusters of virtual machines in Kubernetes, arises from improper elimination of certain elements. This allows an attacker to perform arbitrary actions on the host system.	27 May 202400:00	–	bdu_fstec
CBLMariner	CVE-2024-3154 affecting package cri-o for versions less than 1.30.1-1	21 Jun 202409:32	–	cbl_mariner
CBLMariner	CVE-2024-3154 affecting package cri-o for versions less than 1.22.3-2	12 Jun 202422:23	–	cbl_mariner
Chainguard	CVE-2024-3154 vulnerabilities	26 Apr 202404:15	–	cgr
Circl	CVE-2024-3154	29 Apr 202416:19	–	circl
CNNVD	CRI-O 命令注入漏洞	22 Apr 202400:00	–	cnnvd

Vulners

Node

kubernetes cri-oRange1.28.0–1.28.6

kubernetes cri-oRange1.29.0–1.29.4

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-3154
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/opencontainers/runtime-spec/blob/main/features.md
access	www.access.redhat.com/security/cve/CVE-2024-3154
access	www.access.redhat.com/errata/RHSA-2024:2669
github	www.github.com/cri-o/cri-o
github	www.github.com/opencontainers/runc/pull/4217
access	www.access.redhat.com/errata/RHSA-2024:3496
github	www.github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
access	www.access.redhat.com/downloads/content/package-browser/

06 Oct 2026 02:44Current

CVSS 3.17.2

CVSS 48.6

EPSS0.01418

SSVC