CVE-2024-10220

A flaw was found in the Kubelet component from the Kubernetes package. This flaw allows an attacker to create a pod and an associated gitRepo volume to execute arbitrary commands outside the container, bypassing the intended isolation between the container and the host.

This vulnerability is classified as important severity due to its potential to allow arbitrary command execution beyond the container boundary, which can lead to severe security breaches. By leveraging the hooks folder in the target repository associated with the gitRepo volume, an attacker can execute commands on the host system or other pods within the cluster. This can result in unauthorized access, data exfiltration, or privilege escalation, making it far more impactful than a moderate vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users can restrict the usage of gitRepo volumes in their cluster using policies such as ValidatingAdmissionPolicy. The following CEL expression can be used as part of the policy to restrict the use of gitRepo volumes:

has(object.spec.volumes) || !object.spec.volumes.exists(v, has(v.gitRepo))
~~