GO-2024-2919: Cri-o: malicious container can create symlink on host

Published Jun 12, 2024

Updated

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

Affected Software

1 affected component

cri-o cri-o

Event History

Jun 12, 2024

CVE Published

via OSV·08:51 AM

Data Sourced

via OSV·08:51 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and conditions does an attacker need to exploit this issue?

The supplied severity vector indicates network reachability, low attack complexity, high privileges required, and required user interaction. Exploitation involves a malicious container.

Are affected CRI-O versions or temporary mitigations identified?

The provided information does not identify affected or fixed versions, default-configuration exposure, detection methods, or compensating mitigations.

GO-2024-2919: Cri-o: malicious container can create symlink on host

Affected Software

Event History

Frequently Asked Questions

What access and conditions does an attacker need to exploit this issue?

Are affected CRI-O versions or temporary mitigations identified?

Company

Resources

Contact

Frequently Asked Questions

What access and conditions does an attacker need to exploit this issue?

Are affected CRI-O versions or temporary mitigations identified?