CVE-2024-5154: Symlink Vulnerability in cri-o

The core of this vulnerability lies in cri-o's insufficient controls over container filesystem operations. A malicious container, if compromised, can leverage this weakness to create a symlink named "mtab" directly on the host's filesystem. The 'mtab' file is a critical system file used by the Linux kernel to manage mounted filesystems. By creating a symlink with this name, an attacker could potentially redirect the kernel to point to a malicious location, allowing them to manipulate the host's filesystem and gain elevated privileges. This could lead to complete host compromise, including data theft, system disruption, and further lateral movement within the network. While the direct impact is privilege escalation, the potential for broader damage is significant.

1. Reserved2024-05-20
2. Published2024-06-14
3. Modified2026-03-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-5154 is to upgrade cri-o to version 1.28.7 or later. This version includes fixes that prevent the creation of the malicious "mtab" symlink. If upgrading immediately is not feasible, consider implementing stricter container isolation policies to limit the container's access to the host filesystem. This could involve using namespaces and cgroups to restrict the container's ability to create files outside of its designated mount point. Additionally, monitor container activity for suspicious filesystem operations, particularly the creation of symlinks in unexpected locations. After upgrading, verify the fix by attempting to create a symlink named 'mtab' within a container and confirming that the operation is denied.