CVE-2024-43803
Description
A flaw was found in the Bare Metal Operator (BMO). The BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost (BMH) CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for the Name and Namespace of the Secret, meaning that the baremetal-operator will read a Secret from any namespace. This flaw allows a user with access to create or edit a BareMetalHost can exfiltrate a Secret from another namespace by using it as the userData for provisioning some host, for example. Note that this need not be a real host; it could be a random VM.
Statement
This issue is considered moderate rather than important because it requires specific conditions to be exploited. The vulnerability relies on an attacker already having the ability to create or modify a BareMetalHost resource, which typically requires elevated permissions. Furthermore, the flaw only allows exfiltration of Secrets by referencing them in another namespace, but does not directly expose or escalate privileges across the cluster. It also doesn't impact the integrity or availability of the system but is limited to confidentiality concerns within a specific scope. Proper RBAC policies can mitigate this risk, reducing its overall severity.
Mitigation
The Operator can configure BMO RBAC to be the namespace scoped for Secrets, instead of the cluster scoped to prevent BMO from accessing Secrets from other namespaces.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
