Bug 2323060 (CVE-2024-10220)

Summary:	CVE-2024-10220 kubernetes: Arbitrary command execution through gitRepo volume
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bradley.g.smith, brking, cfeist, gtanzill, haoli, hkataria, jajackso, jcammara, jmitchel, jneedle, kegrant, koliveir, kshier, mabashia, oalbrigt, pbraun, security-response-team, shvarugh, simaishi, smcdonal, stcannon, teagle, tfister, thavo, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the Kubelet component from the Kubernetes package. This flaw allows an attacker to create a pod and an associated gitRepo volume to execute arbitrary commands outside the container, bypassing the intended isolation between the container and the host.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2332234, 2332235, 2332236, 2332237, 2332238
Bug Blocks:
Deadline:	2024-11-08

Description OSIDB Bzimport 2024-10-31 21:12:10 UTC

A security vulnerability was discovered in Kubernetes that could allow a user with the ability to create a pod and associate a gitRepo volume to execute arbitrary commands beyond the container boundary. This vulnerability leverages the hooks folder in the target repository to run arbitrary commands outside of the container's boundary.

Comment 2 Brad Smith 2024-12-13 20:14:35 UTC

Unversioned Kubernetes is available via kubernetes-1.29.11 in F40 and F41.
Versioned Kubernetes is available via kubernetes1.29-1.29.11, kubernetes1.30-1.30.7, kubernetes1.31-1.31.1, and kubernetes1.32-1.32.0.

Vulnerable versions are (https://www.cve.org/CVERecord?id=CVE-2024-10220):

affected

    affected from 0 through 1.28.11 

    affected from 1.29.0 through 1.29.6 

    affected from 1.30.0 through 1.30.2 

unaffected

    unaffected at 1.31.0 

All current versions of Fedora kubernetes rpms are fixed or not affected.