CVE-2024-3154

Cri-o: arbitrary command injection via pod annotation

State: Published
Severity: 7.2 High
Published: Apr 26, 2024
Updated: Aug 24, 2026
Reserved: Apr 1, 2024

Description

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
cri-o	1.27.5Affected 1.27.6Not affected 1.28.5Affected 1.28.6Not affected 1.29.3Affected 1.29.4Not affected 1.30.0Not affected
Red Hat OpenShift Container Platform 4.12Red Hat	0:1.25.5-16.2.rhaos4.12.gitcb09013.el8 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	0:1.26.5-16.2.rhaos4.13.git67e2a9d.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	0:1.27.6-2.rhaos4.14.gitb3bd0bf.el9 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	0:1.28.6-2.rhaos4.15.git77bbb1c.el8 and laterNot affected
Red Hat OpenShift Container Platform 3.11Red Hat

References

RHSA-2024:2669vendor-advisory
RHSA-2024:2672vendor-advisory
RHSA-2024:2784vendor-advisory
RHSA-2024:3496vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-3154vdb-entry
RHBZ#2272532issue-tracking
https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j
https://github.com/opencontainers/runc/pull/4217
https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.