Loading vulnerability…
OpenShift Privileged Build Pod Node Compromise
CVE-2024-45496 is an improper use of elevated privileges in the OpenShift Container Platform build process. During build initialization, the git-clone container executes with a privileged security context rather than the restrictions expected for developer-supplied build content. A developer can supply crafted Git configuration that causes commands to execute during repository cloning. Because the affected container is privileged, those commands execute with unrestricted access to the worker node hosting the build pod.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary command execution on the affected OpenShift worker node. An attacker can escape the intended build isolation boundary, escalate from developer-level cluster access to node-level control, and potentially take over the node and access workloads, data, credentials, and resources reachable from that node.
If you can’t patch tonight, do this now.
Until an update is deployed, restrict developer access and permissions that allow creation or execution of builds using Git-sourced content. Limit build capability to trusted users, review build configurations and repository-supplied Git configuration, and monitor build activity for unexpected command execution or privileged build-pod behavior.
Patch, then assume compromise.
Upgrade OpenShift Container Platform and affected openshift-controller-manager component images through the applicable Red Hat release channel. OpenShift Container Platform 4.16.13 includes remediation for this issue; use the vendor-supported fixed release applicable to the deployed OpenShift version and architecture.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.