Critical [CVE-2024-45496] Openshift-controller-manager: elevated build pods can lead to node compromise in openshift

A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process.

During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted.gitconfig file containing commands executed during the cloning process, leading to arbitrary command execution on the worker node.

An attacker running code in a privileged container could escalate their permissions on the node running the container. In all versions of OpenShift, the "Custom" build strategy gives developers permission to run arbitrary commands in a privileged container.

This is disabled by default, and documentation explicitly warns that this should only be enabled for highly trusted users (eg: cluster admins). We therefore do not consider this vulnerability a privilege escalation path for "Custom" strategy builds.

Microshift is not affected by this vulnerability. Red Hat severity: Important — CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).

Weakness: CWE-269.

Affected products named by the advisory: Red Hat OpenShift Container Platform 4.12; Red Hat OpenShift Container Platform 4.13; Red Hat OpenShift Container Platform 4.14; Red Hat OpenShift Container Platform 4.15; and 3 more.