CVE-2024-3154CWE-77command-injection

CVE-2024-3154

High · published April 26, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
72.6
In the wild
Unconfirmed
What it is

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01418 · 72.6th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2024-04-26T08:15Z
References (18)
https://access.redhat.com/errata/RHSA-2024:2669 · [email protected]https://access.redhat.com/errata/RHSA-2024:2672 · [email protected]https://access.redhat.com/errata/RHSA-2024:2784 · [email protected]https://access.redhat.com/errata/RHSA-2024:3496 · [email protected]https://access.redhat.com/security/cve/CVE-2024-3154 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2272532 · [email protected]https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j · [email protected]https://github.com/opencontainers/runc/pull/4217 · [email protected]https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson · [email protected]https://access.redhat.com/errata/RHSA-2024:2669 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:2672 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:2784 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:3496 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2024-3154 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2272532 · af854a3a-2127-422b-91ae-364da2661108https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j · af854a3a-2127-422b-91ae-364da2661108https://github.com/opencontainers/runc/pull/4217 · af854a3a-2127-422b-91ae-364da2661108https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 26 APR 03:12Z
    Cri-o: arbitrary command injection via pod annotation
    cvelistv5