CVE-2024-10220

Description

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2.

CVSS Metrics

• v4.0•HIGH•Score: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
• v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 3.03%• Percentile: 87%

Techniques & Countermeasures

• CWE-22•Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected Systems

• chainguard•argo-cd-2.11

  all

• chainguard•argocd-image-updater

  < 0.17.0-r1

• chainguard•argocd-image-updater-fips

  < 0.17.0-r2

• chainguard•aws-efs-csi-driver

  < 2.1.2-r0

• chainguard•aws-efs-csi-driver-fips

  < 2.1.2-r0

• chainguard•gpu-feature-discovery

  < 0.8.2-r6

• chainguard•ip-masq-agent

  < 2.12.0-r0

• chainguard•kubeflow-pipelines

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-apiserver

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-cache_server

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-cache-deployer

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-cache-deployer-compat

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-frontend

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-metadata-envoy-config

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-metadata-writer

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-metadata-writer-compat

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-persistence_agent

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-scheduledworkflow

  < 2.3.0-r3

• chainguard•kubeflow-pipelines-viewer-crd-controller

  < 2.3.0-r3

• chainguard•kubernetes-dns-node-cache

  < 1.23.1-r5

• chainguard•kubernetes-dns-node-cache-fips

  < 1.23.1-r4

• chainguard•local-static-provisioner

  < 2.7.0-r8

• chainguard•local-static-provisioner-compat

  < 2.7.0-r8

• chainguard•local-static-provisioner-fips

  < 2.7.0-r1

• chainguard•local-static-provisioner-fips-compat

  < 2.7.0-r1

• chainguard•local-volume-node-cleanup

  < 2.7.0-r8

• chainguard•local-volume-node-cleanup-compat

  < 2.7.0-r8

• chainguard•local-volume-node-cleanup-fips

  < 2.7.0-r1

• chainguard•local-volume-node-cleanup-fips-compat

  < 2.7.0-r1

• chainguard•nodetaint

  < 0.0.4-r23

• chainguard•rancher-webhook-0.4

  < 0.4.18-r2

• chainguard•rancher-webhook-0.5

  < 0.5.12-r17

• chainguard•rancher-webhook-fips-0.4

  < 0.4.18-r4

• chainguard•rancher-webhook-fips-0.5

  < 0.5.11-r0

• wolfi•argocd-image-updater

  < 0.17.0-r1

• wolfi•aws-efs-csi-driver

  < 2.1.2-r0

• wolfi•gpu-feature-discovery

  < 0.8.2-r6

• wolfi•ip-masq-agent

  < 2.12.0-r0

• wolfi•kubeflow-pipelines

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-apiserver

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-cache_server

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-cache-deployer

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-cache-deployer-compat

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-frontend

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-metadata-envoy-config

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-metadata-writer

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-metadata-writer-compat

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-persistence_agent

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-scheduledworkflow

  < 2.3.0-r3

• wolfi•kubeflow-pipelines-viewer-crd-controller

  < 2.3.0-r3

Showing first 50 affected entries in server-rendered view.

References (10)

• https://github.com/kubernetes/kubernetes/issues/128885
• https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko
• http://www.openwall.com/lists/oss-security/2024/11/20/1
• https://nvd.nist.gov/vuln/detail/CVE-2024-10220
• https://github.com/kubernetes/kubernetes/commit/1ab06efe92d8e898ca1931471c9533ce94aba29b
• https://github.com/kubernetes/kubernetes
• https://pkg.go.dev/vuln/GO-2024-3286
• https://github.com/advisories/GHSA-27wf-5967-98gx
• https://security-tracker.debian.org/tracker/CVE-2024-10220
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10220.json