A privilege escalation vulnerability exists in the build functionality of OpenShift Container Platform. An attacker with 'admin' role in a project is able to escalate privileges to cluster-admin cluster role if builds are enabled.
Acknowledgments: Name: Philippe Suzzoni (Bell Canada)
Upstream Commit: https://github.com/openshift/builder/pull/202
Builds in OCP 3.11 use a different method to that in OCP 4.x and therefore don't expose this vulnerability.
Mitigation: The affected build strategies include docker, source and custom builds, hence these can be disabled as per the documentation[1]. This does however, exclude the Jenkins build strategy as it is not affected and does not have to be disabled. [1] https://docs.openshift.com/container-platform/4.6/builds/securing-builds-by-strategy.html On clusters where builds are allowed only grant permissions to perform builds to users who you wish to be to able to view, modify and edit all cluster resources.
Used fixcvenames on OCP 4.6 tracker as this got released: https://access.redhat.com/errata/RHBA-2021:0235
Used fixcvenames on OCP 4.5 tracker as this got released: https://access.redhat.com/errata/RHBA-2021:0231
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.4 Via RHSA-2021:0281 https://access.redhat.com/errata/RHSA-2021:0281
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-20182