Most recent entries from all

bdu:2024-04112

2026-10-15T04:51:31.101370+00:00

bdu:2024-04112

certfr-2024-avi-0841 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

2026-10-15T04:51:31.101405+00:00

certfr-2024-avi-0841

EUVD-2026-358083

2026-10-15T04:51:31.101423+00:00

EUVD-2026-358083

fkie_cve-2024-3154

2026-10-15T04:51:31.101435+00:00

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

GHSA-2cgq-h8xw-2v5j — CRI-O vulnerable to an arbitrary systemd property injection

2026-10-15T04:51:31.101462+00:00

Affected: Go: github.com/cri-o/cri-o

### Impact On CRI-O, it looks like an arbitrary systemd property can be injected via a Pod annotation: ``` --- apiVersion: v1 kind: Pod metadata: name: poc-arbitrary-systemd-property-injection annotations: # I believe that ExecStart with an arbitrary command works here too, # but I haven't figured out how to marshalize the ExecStart struct to gvariant string. org.systemd.property.SuccessAction: "'poweroff-force'" spec: containers: - name: hello image: [quay.io/podman/hello](http://quay.io/podman/hello) ```

This means that any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Tested with CRI-O v1.24 on minikube. I didn't test the latest v1.29 because it is incompatible with minikube: https://github.com/kubernetes/minikube/pull/18367

Thanks to Cédric Clerget (GitHub ID @cclerget) for finding out that CRI-O just passes pod annotations to OCI annotations: https://github.com/opencontainers/runc/pull/3923#discussion_r1532292536

CRI-O has to filter out annotations that have the prefix "org.systemd.property."

See also: - https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson - https://github.com/opencontainers/runc/pull/4217

### Workarounds Unfortunately, the only workarounds would involve an external mutating webhook to disallow these annotations

### References

gsd-2024-3154

2026-10-15T04:51:31.101504+00:00

gsd-2024-3154

msrc_CVE-2024-3154 — Cri-o: arbitrary command injection via pod annotation

2026-10-15T04:51:31.101517+00:00

msrc_CVE-2024-3154

OESA-2024-1671 — runc security update

2026-10-15T04:51:31.101533+00:00

Affected: openEuler:22.03-LTS-SP2: runc

runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fix(es): A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.(CVE-2024-3154)

openSUSE-SU-2024:14334-1 — grype-0.80.1-1.1 on GA media

2026-10-15T04:51:31.101554+00:00

grype-0.80.1-1.1 on GA media

RHSA-2024:2669 — Red Hat Security Advisory: OpenShift Container Platform 4.15.12 security update

2026-10-15T04:51:31.101570+00:00

buildah: Buildah: Container escape via improper bind mount validation cri-o: Arbitrary command injection via pod annotation jose-go: improper handling of highly compressed data

WID-SEC-W-2024-1297 — Red Hat OpenShift: Schwachstelle ermöglicht Codeausführung

2026-10-15T04:51:31.101587+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um beliebigen Programmcode auszuführen.