CVE-2024-3154: Cri-o: arbitrary command injection via pod annotation

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-26 · updated 2026-08-24
Weakness: CWE-77

Description

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Affected products

Red Hat OpenShift Container Platform 4.12: all versions — fixed in 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8
Red Hat OpenShift Container Platform 4.13: all versions — fixed in 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9
Red Hat OpenShift Container Platform 4.14: all versions — fixed in 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9
Red Hat OpenShift Container Platform 4.15: all versions — fixed in 0:1.28.6-2.rhaos4.15.git77bbb1c.el8

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.12 0:1.25.5-16.2.rhaos4.12.gitcb09013.el8; Red Hat OpenShift Container Platform 4.13 0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9; Red Hat OpenShift Container Platform 4.14 0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9; Red Hat OpenShift Container Platform 4.15 0:1.28.6-2.rhaos4.15.git77bbb1c.el8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3154 or the next vulnerability affects your stack