CVE-2024-25132
Description
A flaw was found in the Hive hibernation controller component of OpenShift Dedicated. The ClusterDeployment.hive.openshift.io/v1 resource can be created with the spec.installed field set to true, regardless of the installation status, and a positive timespan for the spec.hibernateAfter value. If a ClusterSync.hiveinternal.openshift.io/v1alpha1 resource is also created, the hive hibernation controller will enter the reconciliation loop leading to a panic when accessing a non-existing field in the ClusterDeployment’s status section, resulting in a denial of service.
Statement
This only affects Hosted Red Hat OpenShift Services.
Mitigation
Red Hat Product Security does not have a recommended mitigation at this time. Please update to a patched version as soon as it is available.
Acknowledgements
This issue was discovered by Thibault Guittet (Red Hat).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
