Cri-o: arbitrary command injection via pod annotation
Priority LOW 37CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.
Summary
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01418 72nd percentileScored 2026-11-08
Fix Fixed cri-o: 1.27.6, 1.28.6, 1.29.4 +1github.com/cri-o/cri-o (Go): 1.29.4, 1.28.6, 1.27.6Red Hat: 4 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | cri-o | 1.27.5; 1.28.5; 1.29.3 | 1.27.6, 1.28.6, 1.29.4, 1.30.0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 1.25.5-16.2.rhaos4.12.gitcb09013.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 1.26.5-16.2.rhaos4.13.git67e2a9d.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1.27.6-2.rhaos4.14.gitb3bd0bf.el9 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1.28.6-2.rhaos4.15.git77bbb1c.el8 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 3.11 | — | — | Not affected | CNA |
| — | github.com/cri-o/cri-o (Go) | 1.29.0 to before 1.29.4 | 1.29.4 | Patch available | GHSA-2cgq-h8xw-2v5j |
| — | github.com/cri-o/cri-o (Go) | 1.28.0 to before 1.28.6 | 1.28.6 | Patch available | GHSA-2cgq-h8xw-2v5j |
| — | github.com/cri-o/cri-o (Go) | before 1.27.6 | 1.27.6 | Patch available | GHSA-2cgq-h8xw-2v5j |
- cri-o Vendor— Affected 1.27.5; 1.28.5; 1.29.3 Fixed in 1.27.6, 1.28.6, 1.29.4, 1.30.0 Patch available CNA
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 1.25.5-16.2.rhaos4.12.gitcb09013.el8 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 1.26.5-16.2.rhaos4.13.git67e2a9d.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1.27.6-2.rhaos4.14.gitb3bd0bf.el9 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1.28.6-2.rhaos4.15.git77bbb1c.el8 Patch available CNA
- Red Hat OpenShift Container Platform 3.11 VendorRed Hat Affected — Fixed in — Not affected CNA
- github.com/cri-o/cri-o (Go) Vendor— Affected 1.29.0 to before 1.29.4 Fixed in 1.29.4 Patch available GHSA-2cgq-h8xw-2v5j
- github.com/cri-o/cri-o (Go) Vendor— Affected 1.28.0 to before 1.28.6 Fixed in 1.28.6 Patch available GHSA-2cgq-h8xw-2v5j
- github.com/cri-o/cri-o (Go) Vendor— Affected before 1.27.6 Fixed in 1.27.6 Patch available GHSA-2cgq-h8xw-2v5j
CPE names CNA · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift:4.12::el8 | 4.12 | — | Red Hat |
| cpe:/a:redhat:openshift:4.12::el9 | 4.12 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el9 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el8 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el8 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el9 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el9 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el8 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:3.11 | 3.11 | — | Red Hat |
- cpe:/a:redhat:openshift:4.12::el8 Versions 4.12 — ·Red Hat
- cpe:/a:redhat:openshift:4.12::el9 Versions 4.12 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el9 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el8 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el8 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el8 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:3.11 Versions 3.11 — ·Red Hat
Remediation
- Fix · CNA cri-o Fixed in 1.27.6, 1.28.6, 1.29.4, 1.30.0
- Fix · GHSA-2cgq-h8xw-2v5j github.com/cri-o/cri-o (Go) Fixed in 1.29.4 Advisory →
- Fix · GHSA-2cgq-h8xw-2v5j github.com/cri-o/cri-o (Go) Fixed in 1.28.6 Advisory →
- Fix · GHSA-2cgq-h8xw-2v5j github.com/cri-o/cri-o (Go) Fixed in 1.27.6 Advisory →
Red Hat 4 advisories
- RHSA-2024:3496 Released 2024-06-05 · Red Hat rating ImportantOpenShift Container Platform 4.13.43 security update
- Red Hat OpenShift Container Platform 4.13 cri-o-1.26.5-16.2.rhaos4.13.git67e2a9d.el8, cri-o-1.26.5-16.2.rhaos4.13.git67e2a9d.el9
- RHSA-2024:2784 Released 2024-05-16 · Red Hat rating ImportantOpenShift Container Platform 4.12.57 security update
- Red Hat OpenShift Container Platform 4.12 cri-o-1.25.5-16.2.rhaos4.12.gitcb09013.el8, podman-3:4.4.1-3.2.rhaos4.12.el8, podman-catatonit-3:4.4.1-3.2.rhaos4.12.el8 +9
- RHSA-2024:2672 Released 2024-05-09 · Red Hat rating ImportantOpenShift Container Platform 4.14.24 packages and security update
- Red Hat OpenShift Container Platform 4.14 cri-o-1.27.6-2.rhaos4.14.gitb3bd0bf.el8, cri-o-1.27.6-2.rhaos4.14.gitb3bd0bf.el9, openshift-4.14.0-202404301807.p0.gfd36fb9.assembly.stream.el8 +16
Show 1 more Red Hat advisories
- RHSA-2024:2669 Released 2024-05-09 · Red Hat rating ImportantOpenShift Container Platform 4.15.12 security update
- Red Hat OpenShift Container Platform 4.15 cri-o-1.28.6-2.rhaos4.15.git77bbb1c.el8, cri-o-1.28.6-2.rhaos4.15.git77bbb1c.el9, podman-3:4.4.1-23.2.rhaos4.15.el8 +12
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:2784 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:3496 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:2672 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:2669 |
Not affected: 4 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3154
- 2026-10-03 Alias added: GHSA-2cgq-h8xw-2v5j
References
Advisory 5
Other 6
- https://access.redhat.com/security/cve/CVE-2024-3154
- RHBZ#2272532
- https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
- https://github.com/opencontainers/runc/pull/4217
- https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson
- https://github.com/cri-o/cri-o
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-3154 · CVE Program
- CVE-2024-3154 · NVD
- FIRST EPSS
- GHSA-2cgq-h8xw-2v5j · GitHub Advisory Database · CC BY 4.0
- CVE-2024-3154 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences