CVE-2024-9594

Description

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.

Reserved 2024-10-07 | Published 2024-10-15 | Updated 2024-10-16 | Assigner kubernetes

VM Images built via Nutanix, OVA, QEMU or raw provider

Problem types

CWE-798 Use of Hard-coded Credentials

Product status

Default status
unaffected

Any version
affected

0.1.38
unaffected

Credits

Nicolai Rybnikar @rybnico from Rybnikar Enterprises GmbH. reporter

References

github.com/kubernetes/kubernetes/issues/128007 vendor-advisory issue-tracking

github.com/kubernetes-sigs/image-builder/pull/1596 patch

groups.google.com/...y-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ mailing-list

cve.org (CVE-2024-9594)

nvd.nist.gov (CVE-2024-9594)

Download JSON