GHSA-c5pj-mqfh-rvc3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-c5pj-mqfh-rvc3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-c5pj-mqfh-rvc3/GHSA-c5pj-mqfh-rvc3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-c5pj-mqfh-rvc3
- Related
- Withdrawn
- 2024-04-30T09:37:23Z
- Published
- 2024-04-26T06:30:34Z
- Modified
- 2024-06-05T18:30:34Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Withdrawn: Runc allows an arbitrary systemd property to be injected
- Details
-
Withdrawn Advisory
This advisory has been withdrawn because it was incorrectly attributed to runc. Please see the issue here for more information.
Original Description
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system. This issue has its root in how runc handles Config Annotations lists.
- Database specific
{ "nvd_published_at": "2024-04-26T04:15:09Z", "cwe_ids": [ "CWE-77" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-04-26T22:44:51Z" }- References
-
- https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
- https://nvd.nist.gov/vuln/detail/CVE-2024-3154
- https://github.com/opencontainers/runc/pull/4217
- https://github.com/opencontainers/runc/commit/3db0871f1cf25c7025861ba0d51d25794cb21623
- https://access.redhat.com/errata/RHSA-2024:2669
- https://access.redhat.com/errata/RHSA-2024:2672
- https://access.redhat.com/errata/RHSA-2024:2784
- https://access.redhat.com/errata/RHSA-2024:3496
- https://access.redhat.com/security/cve/CVE-2024-3154
- https://bugzilla.redhat.com/show_bug.cgi?id=2272532
- https://github.com/opencontainers/runc
- https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson
Affected packages
Go / github.com/opencontainers/runc
Package
- Name
- github.com/opencontainers/runc
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/opencontainers/runc