CVE-2024-43803
개요
A flaw was found in the Bare Metal Operator (BMO). The BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost (BMH) CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for the Name and Namespace of the Secret, meaning that the baremetal-operator will read a Secret from any namespace. This flaw allows a user with access to create or edit a BareMetalHost can exfiltrate a Secret from another namespace by using it as the userData for provisioning some host, for example. Note that this need not be a real host; it could be a random VM.
내용
This issue is considered moderate rather than important because it requires specific conditions to be exploited. The vulnerability relies on an attacker already having the ability to create or modify a BareMetalHost resource, which typically requires elevated permissions. Furthermore, the flaw only allows exfiltration of Secrets by referencing them in another namespace, but does not directly expose or escalate privileges across the cluster. It also doesn't impact the integrity or availability of the system but is limited to confidentiality concerns within a specific scope. Proper RBAC policies can mitigate this risk, reducing its overall severity.
완화 방법
The Operator can configure BMO RBAC to be the namespace scoped for Secrets, instead of the cluster scoped to prevent BMO from accessing Secrets from other namespaces.
CVSS (Common Vulnerability Scoring System) 점수 세부 사항
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 4.9 | N/A | N/A |
| 공격 벡터 | Network | N/A | N/A |
| 공격 복잡성 | Low | N/A | N/A |
| 필요한 권한 | High | N/A | N/A |
| 사용자 상호 작용 | None | N/A | N/A |
| 범위 | Unchanged | N/A | N/A |
| 기밀성 | High | N/A | N/A |
| 무결성에 미치는 영향 | None | N/A | N/A |
| 가용성에 미치는 영향 | None | N/A | N/A |
벡터
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
취약점 이해 (CWE)
Confidentiality
Technical Impact: Read Application Data
