CVE-2024-5154
HIGH severity · CVSS 8.1 · Path traversal
8.1CVSS HIGH
Summary
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredHigh
User interactionRequired
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
Exploit probability (EPSS)1%
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected products we track (3)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://access.redhat.com/errata/RHSA-2024:3676Advisory
- https://access.redhat.com/errata/RHSA-2024:3700Advisory
- https://access.redhat.com/errata/RHSA-2024:4008Advisory
- https://access.redhat.com/errata/RHSA-2024:4486Advisory
- https://access.redhat.com/security/cve/CVE-2024-5154Advisory
- https://access.redhat.com/errata/RHSA-2024:10818
- https://access.redhat.com/errata/RHSA-2024:4159
- https://bugzilla.redhat.com/show_bug.cgi?id=2280190