RedhatVULNRICHMENT:CVE-2024-5154CVE-2024-5154 Cri-o: malicious container can create symlink on host
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
16.6%
SSVC
Exploitation
none
Automatable
no
Technical Impact
total
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“…/“). This flaw allows the container to read and write to arbitrary files on the host system.
References
access.redhat.com/errata/RHSA-2024:3676
access.redhat.com/errata/RHSA-2024:3700
access.redhat.com/errata/RHSA-2024:4008
access.redhat.com/errata/RHSA-2024:4486
access.redhat.com/security/cve/CVE-2024-5154
bugzilla.redhat.com/show_bug.cgi?id=2280190
github.com/cri-o/cri-o/security/advisories/GHSA-j9hf-98c3-wrm8
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
AI Score
Confidence
High
EPSS
Percentile
16.6%
SSVC
Exploitation
none
Automatable
no
Technical Impact
total