CVE-2021-3344: High severity redhat Openshift Builder vulnerability
A privilege escalation flaw was found in OpenShift builder. During build time, credentials outside the build context are automatically mounted into the container image under construction. An OpenShift user, able to execute code during build time inside this container can re-use the credentials to overwrite arbitrary container images in internal registries and/or escalate their privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
In OpenShift Container Platform 4, a privilege escalation path exists in Builds via the re-use of credentials mounted into /run/secrets. An OpenShift user able to execute code in a build container can re-use the credentials to overwrite arbitrary container images in internal registries and potentially execute arbitrary code.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/github.com/openshift/builder v0.0.0-20210125201112to a version that resolves this vulnerability.Fixed in 7901 - Configuration
Disable OpenShift build strategies: docker, source, and custom builds (per OpenShift documentation referenced in the material). Do NOT disable Jenkins build strategy, as it is explicitly stated as not affected.
OpenShift Builds (strategy: docker, source, custom) build strategy enabled/disabled = disabled - Compensating control
On clusters where builds are allowed, grant build permissions only to users you wish to be able to view/modify/edit all cluster resources (limit who can perform builds).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-3344?
CVE-2021-3344 is classified as a high severity privilege escalation vulnerability.
How do I fix CVE-2021-3344?
To fix CVE-2021-3344, update to OpenShift builder version 7901 or later.
Who is affected by CVE-2021-3344?
CVE-2021-3344 affects users of OpenShift builder versions prior to 7901 and OpenShift Container Platform versions 4.5.33 and 4.6.16.
What are the implications of CVE-2021-3344?
The implications of CVE-2021-3344 include the potential for unauthorized access to sensitive credentials during container image builds.
When was CVE-2021-3344 discovered?
CVE-2021-3344 was reported in January 2021.