CVE-2024-5154

cri-o: malicious container can create symlink on host

Loading…

Severity

Important

Red Hat Product Security

8.1

CVSS 3.1

Review impact separately from score.

Published · May 28, 2024

Updated · October 31, 2026

Description

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

Statement

Red Hat OpenShift Container Platform (OCP) includes the vulnerable cri-o library, however it does not load untrusted container, therefore impact is reduced to Important.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

There is no mitigation available for this vulnerability, a package update is required.

CVSS / CWE

CVSS 3.1 · 8.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')