OpenShift Controller Manager Improper Privilege Management

The impact of CVE-2024-45496 is severe. An attacker who can inject a malicious .gitconfig file during the build initialization phase can gain arbitrary command execution on the worker node. This effectively grants them root access to the node, allowing for complete control over the system. They could install malware, steal sensitive data, disrupt services, or pivot to other systems within the network. The privileged nature of the git-clone container amplifies the risk, as it bypasses standard container security restrictions. This vulnerability is particularly concerning given the critical role OpenShift plays in many organizations' container orchestration infrastructure.

Organizations deploying OpenShift Container Platform, particularly those with developer access granted to external contributors or automated build pipelines, are at significant risk. Environments utilizing custom build configurations or integrating external repositories should be prioritized for remediation.

• linux / server:

journalctl -u openshift-controller-manager -g 'git-clone' | grep -i error

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*openshift*'} | Format-List TaskName, Actions

• generic web:

curl -I <openshift_build_endpoint>

1. 2024-09-17Disclosure

   disclosure

2. 2024-09-17Patch

   patch

1. Reserviert2024-08-30
2. Veröffentlicht2024-09-17
3. Geändert2025-01-09
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-45496 is to immediately upgrade to OpenShift Container Platform version 0.0.0-alpha.0.0.20240911 or later. If upgrading is not immediately feasible, consider restricting developer access to the build process to prevent malicious .gitconfig files from being introduced. While not a complete solution, implementing strict network segmentation and limiting lateral movement capabilities can reduce the potential blast radius of a successful exploit. Review and harden the security context of the git-clone container to minimize its privileges. After upgrading, confirm the fix by attempting to trigger the build process with a crafted .gitconfig file and verifying that the malicious commands are not executed.