VDB
CVE-2024-9779
CVE-2024-9779
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.
EPSS 0.45% · 36.8th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
EPSS Score
0.45%
36.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| open-cluster-management.io | ocm | 0, 0 |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | |
| 0.13.0, 0.12.0, 0.12.0 |
Timeline
- Jan 20, 1970 Fix PR Merged
- Dec 17, 2024 CVE Published
- Dec 17, 2024 PoC Published
- Dec 18, 2024 EPSS Score
- Dec 18, 2024 PoC Published
- Jan 4, 2025 EPSS Score
- Jan 20, 2025 EPSS Score
- Feb 6, 2025 EPSS Score
- Feb 22, 2025 EPSS Score
- Mar 11, 2025 EPSS Score
- Mar 27, 2025 EPSS Score
- Apr 2, 2025 Coalition ESS Score
References
- https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0 url
- https://access.redhat.com/security/cve/CVE-2024-9779 technical
- https://bugzilla.redhat.com/show_bug.cgi?id=2317916 technical
- https://github.com/open-cluster-management-io/ocm/pull/325 technical
- https://github.com/open-cluster-management-io/registration-operator/issues/361 technical
- https://nvd.nist.gov/vuln/detail/CVE-2024-9779 advisory
- https://github.com/open-cluster-management-io/OCM package