Skip to content
fr Sign in
8.1 High

CVE-2024-5154 Cri-o: malicious container can create symlink on host

Description

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Exploitable remotely over the network, with an administrator account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
High
Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Affected products and versions

Product Affected versions Fixed in
Red Hat OpenShift Container Platform 4.12 Versions not published
Red Hat OpenShift Container Platform 4.13 Versions not published
Red Hat OpenShift Container Platform 4.14 Versions not published
Red Hat OpenShift Container Platform 4.15 Versions not published
Red Hat OpenShift Container Platform 4.16 Versions not published
Red Hat OpenShift Container Platform 4.17 417.94 earliest → < 417.94.202412040832-0 417.94.202412040832-0
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat OpenShift Container Platform 3.11 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat OpenShift Container Platform 4.12

The 113 CVEs of Red Hat OpenShift Container Platform 4.12 →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-75888 A flaw was found in the OpenShift console 7.7 High CVE-2026-93017 The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core… 7.7 High CVE-2026-83589 A flaw was found in oauth-proxy 6.1 Medium
Track this CVE