CVE-2024-45497: OpenShift Build Process DOS Vulnerability

CVE-2024-45497 Overview

CVE-2024-45497 is a high-severity flaw in the OpenShift build process. The docker-build container mounts the node's /var/lib/kubelet/config.json file into the build pod through a hostPath volume. The mount is writable rather than read-only, allowing an attacker who controls the build to overwrite node-level image pull credentials. Successful exploitation causes denial of service by breaking image pulls on the node and can expose sensitive registry credentials to unauthorized parties. The weakness is classified under [CWE-732: Incorrect Permission Assignment for Critical Resource].

Critical Impact

An authenticated user with build access can overwrite node kubelet pull credentials, disrupting image pulls across workloads and exfiltrating private registry secrets.

Affected Products

• Red Hat OpenShift Container Platform (builds using docker-build strategy)
• OpenShift Builds operator components referenced in Red Hat Security Advisories
• Downstream OpenShift-based distributions relying on the affected build controller

Discovery Timeline

• 2024-12-31 - CVE-2024-45497 published to the National Vulnerability Database (NVD)
• 2026-08-23 - Last updated in NVD database

Technical Details for CVE-2024-45497

Vulnerability Analysis

The OpenShift docker-build container is provisioned with a hostPath volume that maps the node's /var/lib/kubelet/config.json into the build pod. This file stores the credentials the kubelet uses to authenticate against private container registries when pulling images. Because the mount is not marked readOnly: true, code executing inside the build pod inherits write access to a node-scoped credential file.

An attacker who can submit or influence a build can read those credentials directly from the mounted path. They can also overwrite the file with invalid content, corrupt JSON, or attacker-controlled entries. Once the file is tampered with, the kubelet on that node fails subsequent image pull operations, breaking workload scheduling for any pod that requires a fresh image. The impact combines credential disclosure with denial of service on the affected node.

Root Cause

The root cause is an insecure volume configuration in the build controller. Mounting a sensitive node file into a workload pod without enforcing readOnly semantics violates least-privilege principles for shared resources ([CWE-732]).

Attack Vector

Exploitation requires low-privileged access to trigger a docker-build in the cluster. During the build, the attacker reads config.json to harvest registry credentials, then writes malformed data back to the same path. See the Red Hat CVE-2024-45497 advisory for full technical context. No verified public exploit code is available.

Detection Methods for CVE-2024-45497

Indicators of Compromise

• Unexpected modifications to /var/lib/kubelet/config.json on OpenShift worker nodes, particularly write events originating from build pods.
• Image pull failures across multiple pods on a single node with ImagePullBackOff or authentication errors against private registries.
• Build pods issuing file I/O against host-mounted kubelet configuration paths.

Detection Strategies

• Audit Kubernetes pod specifications for hostPath volumes that map kubelet paths without readOnly: true.
• Correlate node-level file integrity events on config.json with active build pod lifecycles.
• Alert on registry authentication errors from the kubelet that begin immediately after a docker-build completes.

Monitoring Recommendations

• Enable file integrity monitoring on /var/lib/kubelet/config.json across all worker nodes.
• Ingest OpenShift audit logs and kubelet logs into a centralized platform to correlate build activity with credential access.
• Track admission controller decisions for build pods and flag any pod requesting writable host mounts of kubelet directories.

How to Mitigate CVE-2024-45497

Immediate Actions Required

• Apply the Red Hat security updates referenced in RHSA-2025:9269, RHSA-2025:9278, RHSA-2025:9562, RHSA-2025:9759, RHSA-2025:9765, RHSA-2025:10270, RHSA-2025:10294, and RHSA-2025:10747.
• Rotate any pull secrets and registry credentials that may have been exposed on affected nodes.
• Restrict who can create or modify builds in production namespaces using RBAC.

Patch Information

Red Hat has published fixes across multiple OpenShift streams through the advisories listed above. Consult the Red Hat Bugzilla Report #2308673 and the Red Hat CVE-2024-45497 page to identify the exact package versions that align with your cluster release channel.

Workarounds

• Until patches are applied, block the docker-build strategy for untrusted users via admission policy or SecurityContextConstraints.
• Use policy engines such as OPA Gatekeeper or Kyverno to deny pods that mount kubelet host paths without readOnly: true.
• Isolate build workloads onto dedicated worker nodes so credential exposure and pull-failure impact stay contained.

# Example Kyverno policy fragment to deny writable kubelet hostPath mounts
# Consult vendor documentation before enforcing in production
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: deny-writable-kubelet-hostpath
spec:
  validationFailureAction: enforce
  rules:
    - name: block-writable-kubelet-mount
      match:
        any:
          - resources:
              kinds: ["Pod"]
      validate:
        message: "hostPath mounts under /var/lib/kubelet must be readOnly"
        pattern:
          spec:
            containers:
              - volumeMounts:
                  - mountPath: "/var/lib/kubelet/*"
                    readOnly: true