OpenShift Build Process Vulnerability Affecting Red Hat Products

CVE-2024-45497

Summary

A significant vulnerability exists in the OpenShift build process, where the docker-build container is improperly configured with a hostPath volume mount that links the node's /var/lib/kubelet/config.json file to the build pod. This critical file contains sensitive credentials essential for accessing private repositories. The flawed configuration permits unprivileged write access, allowing attackers to overwrite this file. As a result, by modifying the config.json file, an attacker can cause a denial of service, disrupting the ability of the node to pull new container images. Additionally, this vulnerability poses significant risks by potentially allowing unauthorized access to sensitive credentials, which could lead to further compromises within the system.

References