CVE-2024-3154: Cri-o: arbitrary command injection via pod annotation
Withdrawn Advisory
This advisory has been withdrawn because it was incorrectly attributed to runc. Please see the issue here for more information.
Original Description
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system. This issue has its root in how runc handles Config Annotations lists.
Other sources
Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: # I believe that ExecStart with an arbitrary command works here too, # but I haven't figured out how to marshalize the ExecStart struct to gvariant string. org.systemd.property.SuccessAction: "'poweroff-force'" spec: containers: - name: hello image: quay.io/podman/hello
This means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
Tested with CRI-O v1.24 on minikube. I didn't test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367
Thanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations: https://github.com/opencontainers/runc/pull/3923#discussionr1532292536
CRI-O has to filter out annotations that have the prefix "org.systemd.property."
See also: - https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson - https://github.com/opencontainers/runc/pull/4217
Workarounds Unfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations
References
— GitHub
CRI-O could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by an arbitrary systemd property injection. By sending a specially crafted request using pod annotation, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
— IBM
Cri-o: arbitrary command injection via pod annotation
— Microsoft
On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation. This means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
References:
https://github.com/opencontainers/runc/pull/3923#discussionr1538109353 https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What was the original description of CVE-2024-3154?
CVE-2024-3154 was originally described as a flaw found in cri-o that allowed for arbitrary systemd manipulation.
Which versions of cri-o are affected by CVE-2024-3154?
CVE-2024-3154 affects cri-o versions up to 1.27.5, between 1.28.0 and 1.28.5, and between 1.29.0 and 1.29.3.
What is the recommended fix for CVE-2024-3154?
To fix CVE-2024-3154, upgrade cri-o to version 1.27.6, 1.28.6, or 1.29.4, or use the appropriate version for other affected packages.
Is there any specific software or products impacted by CVE-2024-3154?
Yes, IBM Concert Software versions 1.0.0 to 1.0.1 are also impacted by CVE-2024-3154.
What actions have been taken regarding CVE-2024-3154's advisory status?
The advisory for CVE-2024-3154 has been withdrawn due to incorrect attribution to runc.