Skip to content
Fencer Vulns
critical 9.9

CVE-2024-45496 json

Openshift-controller-manager: elevated build pods can lead to node compromise in openshift

published 2024-09-16 2 y ago modified 2026-08-11 2 mo ago also GHSA-j8gh-87rx-c7w9 , GO-2024-3128 , EUVD-2024-2818

cvss
9.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits
0
none known

Summary

A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted .gitconfig file containing commands executed during the cloning process, leading to arbitrary command execution on the worker node. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Patch / fix

  • go github.com/openshift/openshift-controller-manager 0.0.0-alpha.0.0.20240911
  • Red Hat Red Hat OpenShift Container Platform 4.12 v4.12.0-202409131137.p1.g0b1971a.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.13 v4.13.0-202409130707.p1.gb75d499.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.14 v4.14.0-202409130708.p1.g9020ea1.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.15 v4.15.0-202409131835.p1.gbe9d673.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.16 v4.16.0-202409130937.p1.g5dcfc99.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.17 v4.17.0-202409182235.p0.g7682a61.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.18 v4.18.0-202501230001.p0.g0e11616.assembly.stream.el9, v4.18.0-202501230001.p0.g3f6d1d8.assembly.stream.el9, v4.18.0-202501230001.p0.g07daee4.assembly.stream.el9, v4.18.0-202501230001.p0.g11ced00.assembly.stream.el9, v4.18.0-202501230001.p0.g24a6532.assembly.stream.el9, v4.18.0-202501230001.p0.g088dcaf.assembly.stream.el9, v4.18.0-202501230001.p0.g962ccca.assembly.stream.el9, v4.18.0-202501230001.p0.g3193a75.assembly.stream.el9, v4.18.0-202501230001.p0.g5348c85.assembly.stream.el9, v4.18.0-202501230001.p0.g7149f2d.assembly.stream.el9, v4.18.0-202501230001.p0.gba2234b.assembly.stream.el9, v4.18.0-202501230001.p0.gd4fb1b6.assembly.stream.el9, v4.18.0-202501230001.p0.gf648c78.assembly.stream.el9, v4.18.0-202502040032.p0.g5348c85.assembly.stream.el9, v4.18.0-202502040032.p0.ge5a4005.assembly.stream.el9, v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9, v4.18.0-202502041302.p0.g51a74ac.assembly.stream.el9, v4.18.0-202502100301.p0.g2e139ed.assembly.stream.el9, v4.18.0-202502100934.p0.gc00c7c9.assembly.stream.el9, v4.18.0-202502111035.p0.gf76635f.assembly.stream.el9

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-45496 updated cvss 9.9

openshift-controller-manager: Elevated Build Pods Can Lead to Node Compromise in OpenShift

  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-openshift-controller-manager-rhel8 v4.12.0-202409131137.p1.g0b1971a.assembly.stream.el8
    fixed: vendor fix RHSA-2024:6705
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-openshift-controller-manager-rhel8 v4.13.0-202409130707.p1.gb75d499.assembly.stream.el8
    fixed: vendor fix RHSA-2024:6691
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-openshift-controller-manager-rhel8 v4.14.0-202409130708.p1.g9020ea1.assembly.stream.el8
    fixed: vendor fix RHSA-2024:6689
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-openshift-controller-manager-rhel9 v4.15.0-202409131835.p1.gbe9d673.assembly.stream.el9
    fixed: vendor fix RHSA-2024:6685
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-openshift-controller-manager-rhel9 v4.16.0-202409130937.p1.g5dcfc99.assembly.stream.el9
    fixed: vendor fix RHSA-2024:6687
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-openshift-controller-manager-rhel9 v4.17.0-202409182235.p0.g7682a61.assembly.stream.el9
    fixed: vendor fix RHSA-2024:3718
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202502100215-0, openshift4/frr-rhel9 v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.18.0-202502040032.p0.ga50d4c0.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.18.0-202502051032.p0.gacb9630.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.18.0-202501230001.p0.g914783c.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.18.0-202502110432.p0.g0c7bed9.assembly.stream.el9, +184 more
    fixed: vendor fix RHSA-2024:6122
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202409121052-0, openshift4/ose-docker-builder v4.12.0-202409121032.p1.g609473f.assembly.stream.el8, openshift4/ose-cluster-node-tuning-operator v4.12.0-202409120029.p0.g20966da.assembly.stream.el8 Red Hat OpenShift Container Platform 4.13 openshift4/ose-docker-builder v4.13.0-202409120505.p1.g2c7e99d.assembly.stream.el8 Red Hat OpenShift Container Platform 4.14 openshift4/ose-docker-builder v4.14.0-202409111409.p1.g52565ca.assembly.stream.el8 Red Hat OpenShift Container Platform 4.15 openshift4/ose-docker-builder v4.15.0-202409101936.p1.ge7749a3.assembly.stream.el8 Red Hat OpenShift Container Platform 4.16 openshift4/ose-docker-builder-rhel9 v4.16.0-202409101737.p1.gfee4b58.assembly.stream.el9 Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202409121747-0, openshift4/frr-rhel9 v4.17.0-202409100034.p0.g377d02f.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.17.0-202409111134.p0.gbc58b3a.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.17.0-202409121706.p0.gd3adea4.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.17.0-202409100034.p0.g1fb3165.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.17.0-202409130304.p0.g08f2f5f.assembly.stream.el9, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
GitHub 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Affected packages

ecosystem package affected fixed in
go github.com/openshift/openshift-controller-manager
<0.0.0-alpha.0.0.20240911
all versions
0.0.0-alpha.0.0.20240911

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.