Exécution de code à distance dans Rancher via les pilotes de cluster/nœud

The impact of CVE-2024-22036 is severe. Successful exploitation allows an attacker to gain root access within the Rancher container, enabling them to execute arbitrary code. In production environments, this could lead to privilege escalation and compromise of sensitive data. In test and development environments utilizing privileged Docker containers, the attacker can escape the container entirely and gain execution access on the host system, potentially leading to full system compromise. This vulnerability resembles container escape exploits, allowing attackers to move laterally and potentially impact other systems connected to the network.

Organizations heavily reliant on Rancher for Kubernetes management, particularly those with production environments and privileged Docker container deployments, are at significant risk. Shared hosting environments utilizing Rancher are also vulnerable, as a compromised driver could impact multiple tenants.

• linux / server:

journalctl -u rancher -g "chroot jail escape"

• linux / server:

lsof -i -P | grep rancher

• kubernetes: Inspect Kubernetes pod configurations for unusual driver permissions or network access. • kubernetes: Review Rancher audit logs for suspicious driver activity or attempts to escalate privileges.

1. 2025-04-16Disclosure

   disclosure

1. Réservé2024-01-04
2. Publiée2025-04-16
3. Modifiée2026-02-26
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2024-22036 is to upgrade Rancher to version 2.9.3 or later. If an immediate upgrade is not feasible, consider implementing stricter access controls and network segmentation to limit the potential blast radius of a successful attack. Review and restrict the permissions granted to cluster and node drivers. While a WAF or proxy cannot directly prevent this container escape, it can help mitigate the impact by limiting exposure of vulnerable endpoints. After upgrading, verify the fix by attempting to execute a malicious driver command and confirming that it is blocked.