6706 matches found
SUSE CVE-2024-7558
JUJUCONTEXTID is a predictable authentication secret. On a Juju machine non-Kubernetes or Juju charm container on Kubernetes, an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJUCONTEXTID value. This gives the unprivileged user access to t...
SUSE CVE-2024-8038
Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks...
GO-2024-3230 Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno
Kyverno's PolicyException objects can be created in any namespace by default in github.com/kyverno/kyverno...
SUSE CVE-2024-48921
Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this...
Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...
Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...
Kyverno's PolicyException objects can be created in any namespace by default
Summary A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. Details By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to...
CVE-2024-48921
CVE-2024-48921 affects Kyverno, a Kubernetes policy engine. A kyverno ClusterPolicy such as disallow-privileged-containers can be bypassed by creating a PolicyException in any namespace, since PolicyExceptions are consumed from any namespace. This creates a privilege-elevation risk where users wi...
ROS-20241029-14
The vulnerability in the Podman OCI container management and launching software tool is related to issues with the symbolic link issues when running a malicious image using the automatically assigned user namespace --userns=auto. Exploitation of the vulnerability could allow an attacker to create...
ROS-20241029-15
The vulnerability in the Podman OCI container management and launching software tool is related to issues with the symbolic link issues when running a malicious image using the automatically assigned user namespace --userns=auto. Exploitation of the vulnerability could allow an attacker to create...
Kyverno authorization issue vulnerability
Kyverno is a policy engine designed for Kubernetes open-sourced by Kyverno. An authorization issue vulnerability exists prior to Kyverno version 1.13.0, which stems from kyverno ClusterPolicy and can be overridden by creating a PolicyException in a random namespace...
PT-2024-33271
Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.13.0 Description A kyverno ClusterPolicy can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace, which may allow users with privileg...
ROS-20241029-03
The vulnerability in the Podman OCI container management and launching software tool is related to issues with the symbolic link issues when running a malicious image using the automatically assigned user namespace --userns=auto. Exploitation of the vulnerability could allow an attacker to create...
SUSE CVE-2024-49974
In the Linux kernel, the following vulnerability has been resolved: NFSD: Limit the number of concurrent async COPY operations Nothing appears to limit the number of concurrent async COPY operations that clients can start. In addition, AFAICT each async COPY can copy an unlimited number of 4MB...
CLSA-2024-1729869774 kernel: Fix of 12 CVEs
ftrace: Fix possible use-after-free issue in ftracelocation CVE-2024-38588 - ftrace: Fix possible warning on checking all pages used in ftraceprocesslocs CVE-2024-38588 - ftrace: Store the order of pages allocated in ftracepage CVE-2024-38588 - ftrace: Check if pages were allocated before calling...
PT-2024-34129
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.12.0-rc3-custom-gd95d9a31aceb Description: The issue is related to a suspicious RCU usage warning in the ip tunnel find function. The per-netns IP tunnel hash table is protected by the RTNL mutex, and ip tunne...
Linux get_net_ns() Buffer Overflow DoS
The vulnerability of the getnetns function in the net/core/netnamespace.c module of the Linux kernel is related to the reutilization of previously freed memory due to competitive access to resources race condition. Exploiting this vulnerability can allow an attacker to compromise the...
PT-2024-35621
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been resolved in the Linux kernel. The problem occurs when percpu memory allocation fails during the creation of a new IPC namespace, and the failure is not handl...
SUSE CVE-2022-48970
In the Linux kernel, the following vulnerability has been resolved: afunix: Get userns from inskb in unixdiaggetexact. Wei Chen reported a NULL deref in skuserns 01, and Paolo diagnosed the root cause: in unixdiaggetexact, the newly allocated skb does not have sk. 2 We must get the userns from th...
SUSE CVE-2022-49003
In the Linux kernel, the following vulnerability has been resolved: nvme: fix SRCU protection of nvmenshead list Walking the nvmenshead siblings list is protected by the head's srcu in nvmensheadsubmitbio but not nvmempathrevalidatepaths. Removing namespaces from the list also fails to synchroniz...