Bug 2337297 (CVE-2024-9042)

Summary:	CVE-2024-9042 kubelet: Command Injection affecting Windows nodes via nodes/*/logs/query API
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alcohan, amctagga, anjoseph, danken, dfreiber, drow, dymurray, eglynn, fdeutsch, gparvin, jaharrin, jburrell, jeder, jforrest, jjoyce, jkoehler, jmatthew, jprabhak, jschluet, lhh, lphiri, lsvaty, mburns, mgarciac, mwringe, njean, nobody, oramraz, owatkins, pahickey, pgrist, rhaigner, rjohnson, sakbas, security-response-team, smullick, stirabos, thason, vkumar, whayutin, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Kubernetes Windows nodes. This vulnerability allows a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2025-01-15

Description OSIDB Bzimport 2025-01-13 06:11:59 UTC

Windows nodes are vulnerable to a security issue that allows unauthorized command execution via the /logs endpoint, potentially compromising the host system.

This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

Affected Versions
  *   v1.32.0
  *   v1.31.0 to v1.31.4
  *   v1.30.0 to v1.30.8
  *   <=v1.29.12
To detect whether this vulnerability has been exploited, you can examine your cluster's audit logs to search for node 'logs' queries with suspicious inputs.