Withdrawn: Runc allows an arbitrary systemd property to be injected
High severity
GitHub Reviewed
Published
Apr 26, 2024
to the GitHub Advisory Database
•
Updated May 10, 2024
Withdrawn
This advisory was withdrawn on Apr 30, 2024
Package
Affected versions
< 1.2.0-rc.1
Patched versions
1.2.0-rc.1
Description
Published by the National Vulnerability Database
Apr 26, 2024
Published to the GitHub Advisory Database
Apr 26, 2024
Reviewed
Apr 26, 2024
Withdrawn
Apr 30, 2024
Last updated
May 10, 2024
Credits
-
AkihiroSuda Analyst
Withdrawn Advisory
This advisory has been withdrawn because it was incorrectly attributed to runc. Please see the issue here for more information.
Original Description
A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system. This issue has its root in how runc handles Config Annotations lists.
References