Thibault Guittet

يمكن لمهاجم غير مصدق هويته التسبب في رفض الخدمة عن طريق إحداث حالة «نفاد الذاكرة»، مما يؤدي إلى تعطل عملية Java. ويتم ذلك عن طريق إرسال طلبات HTTP متكررة إلى نقطة نهاية TLS. وبناءً على تكوين الخادم، قد تكون هناك حاجة إلى إعادة تشغيل يدوية لاستعادة الخدمة.

يحتوي BlueChi، وهو وحدة تحكم خدمة systemd متعددة العقد تُستخدم في RHIVOS، على ثغرة تتعلق بتبعيات systemd غير المقيدة بين العقد. وهذا يسمح لمستخدم يتمتع بامتيازات الجذر (root) على عقدة مُدارة (qm) بإنشاء أو استبدال ملفات وحدات خدمة systemd التي تؤثر على العقدة المضيفة، مما قد يؤدي إلى تصعيد الامتيازات، وتشغيل خدمات غير مصرح بها، واختراق النظام.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Yggdrasil (لم يتم تحديد الإصدارات المتأثرة) الوصف: تم اكتشاف ثغرة في Yggdrasil، الذي يعمل كوسيط للنظام، مما يسمح للعمليات بالتواصل مع عمليات ”العامل“ التابعة الأخرى من خلال مكون DBus. يقوم Yggdrasil بإنشاء طريقة DBus لإرسال الرسائل إلى العمال، لكنه يغفل فحوصات المصادقة والتفويض، مما يسمح لكل مستخدم في النظام باستدعائها. يعمل أحد عمال Yggdrasil المتاحين كمدير حزم يتمتع بقدرات إنشاء وتمكين مستودعات جديدة وتثبيت الحزم أو إزالتها. يسمح هذا الخلل للمهاجم الذي لديه وصول إلى النظام باستغلال عدم وجود المصادقة على رسالة الإرسال لإجبار عملية «العامل» في Yggdrasil على تثبيت حزم RPM عشوائية، مما يؤدي إلى تصعيد الامتيازات المحلية، مما يمكّن المهاجم من الوصول إلى بيانات النظام الحساسة وتعديلها. التوصيات: في الوقت الحالي، لا توجد معلومات حول إصدار أحدث يحتوي على إصلاح لهذه الثغرة الأمنية.

تم اكتشاف ثغرة في مكون وحدة التحكم في وضع السبات في Hive. يمكن إنشاء المورد ClusterDeployment.hive.openshift.io/v1 مع تعيين الحقل spec.installed على القيمة true وفترة زمنية موجبة لقيمة spec.hibernateAfter. وإذا تم أيضًا إنشاء مورد ClusterSync.hiveinternal.openshift.io/v1alpha1، فسيدخل وحدة التحكم في وضع السبات في Hive في حلقة تسوية متكررة، مما يؤدي إلى رفض الخدمة عند الوصول إلى حقل غير موجود في قسم الحالة في ClusterDeployment.

Name of the Vulnerable Software and Affected Versions: OpenShift versions 4 JBoss Fuse version 7 Description: A flaw was found in the build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories. The mount is not read-only, which allows an attacker to overwrite it. By modifying the config.json file, the attacker can cause a denial of service by preventing the node from pulling new images and potentially exfiltrating sensitive secrets. This issue impacts the availability of services dependent on image pulls and exposes sensitive information to unauthorized parties. Recommendations: For OpenShift version 4, consider disabling the hostPath volume mount until a patch is available to prevent the overwrite of the config.json file. For JBoss Fuse version 7, restrict access to the config.json file to minimize the risk of exploitation. As a temporary workaround, avoid using the `config.json` file in the affected build pod until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the `hive/hive-controllers` pod.

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. This issue allows a non-privileged user on the cluster to create a MustGather object with a specially crafted file and set the most privileged service account to run the job, potentially escalating their privileges to a cluster administrator and pivoting to the AWS environment.

Name of the Vulnerable Software and Affected Versions: ilab model serve component (affected versions not specified) Description: A vulnerability was found in the ilab model serve component, where improper handling of the `best of` parameter in the vllm JSON web API can lead to a Denial of Service (DoS). The API used for LLM-based sentence or chat completion accepts a `best of` parameter to return the best completion from several options. When this parameter is set to a large value, the API does not handle timeouts or resource exhaustion properly, allowing an attacker to cause a DoS by consuming excessive system resources. This leads to the API becoming unresponsive, preventing legitimate users from accessing the service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted `.gitconfig` file containing commands executed during the cloning process, leading to arbitrary command execution on the worker node. An attacker running code in a privileged container could escalate their permissions on the node running the container.

A flaw was found in the Fence Agents Remediation operator, allowing a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the `--ssh-path`/`--telnet-path` arguments. This can lead to a privilege escalation, first as the service account running the operator, then to another service account with cluster-admin privileges. A low-privilege user, such as a user with developer access, can create a specially crafted FenceAgentsRemediation for a fence agent supporting `--ssh-path`/`--telnet-path` arguments to execute arbitrary commands on the operator's pod.

A flaw was found in the OpenShift console, where several endpoints use the `authHandler()` and `authHandlerWithUser()` middleware functions. When the default authentication provider is set to "openShiftAuth", these functions do not perform authentication checks, relying on the targeted service for authentication and authorization. This leads to data exposure due to a lack of proper credential verification.

A flaw was found in the Openshift console, specifically in the `/API/helm/verify` endpoint, which is responsible for fetching and verifying the installation of a Helm chart from a remote HTTP/HTTPS or local URI. The `authHandlerWithUser()` middleware function is supposed to gate access to this endpoint, but it does not verify the validity of the user's credentials, allowing unauthenticated users to access the endpoint.

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted, resulting in memory access on previously freed memory regions. Once freed, a memory region can be reused for other allocations, and any previously stored data in this memory region is considered lost.

A flaw in the authorization procedure of the D-Bus interface com.redhat.RHSM1 allows local privilege escalation. The interface exposes several methods to all users, which can change the state of the registration. By using the `com.redhat.RHSM1.Config.SetAll()` method, a low-privileged local user can tamper with the registration state, potentially unregistering the system or changing current entitlements. This issue can be exploited to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, leading to local privilege escalation to an unconfined root.

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration. The issue is related to the default access control settings of the Keycloak identity and access management tool, which can be exploited by a remote attacker to execute arbitrary code.