CVE-2024-5154: Kubernetes CRI-O Path Traversal Flaw

CVE-2024-5154 Overview

CVE-2024-5154 is a directory traversal vulnerability in cri-o, the Kubernetes Container Runtime Interface implementation for OCI-compatible runtimes. A malicious container can create a symbolic link that points to arbitrary files on the host through ../ traversal sequences. The flaw allows the container to escape the intended filesystem boundary and read or write files on the underlying host system. The issue affects cri-o versions 1.28.6, 1.29.4, and 1.30.0, and downstream products including Red Hat OpenShift Container Platform and Red Hat Enterprise Linux. The vulnerability is tracked as [CWE-22] Path Traversal.

Critical Impact
A malicious container can read and write arbitrary files on the host through symlink-based directory traversal, breaking container isolation and enabling host compromise.

Affected Products

Kubernetes cri-o versions 1.28.6, 1.29.4, and 1.30.0
Red Hat OpenShift Container Platform 3.11, 4.0, and 4.12 through 4.15
Red Hat Enterprise Linux 8.0 and 9.0

Discovery Timeline

2024-06-12 - CVE-2024-5154 published to the National Vulnerability Database (NVD)
2024-06-12 - GitHub Security Advisory GHSA-j9hf-98c3-wrm8 published
2024-06-12 - Red Hat releases errata including RHSA-2024:3676 and RHSA-2024:3700
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5154

Vulnerability Analysis

The vulnerability exists in how cri-o handles filesystem paths inside a container that are intended to be resolved relative to the container's root filesystem. When cri-o processes certain container-supplied paths, it fails to validate symbolic links against the container boundary. A workload running inside the container can create a symlink whose target uses ../ sequences to reach paths on the host filesystem. Subsequent operations initiated by cri-o then follow that symlink and act on host files rather than files inside the container root.

Because cri-o performs the follow-up file operations with elevated host privileges, the container gains read and write access to files it should never touch. Impacted assets include host configuration files, service account tokens, container runtime data, and other node-level secrets. Compromise of these files can lead to lateral movement across the Kubernetes cluster and node takeover.

Root Cause

The root cause is missing path canonicalization and symlink resolution during operations that cross the container-to-host trust boundary. cri-o accepts container-controlled paths without ensuring the resolved path remains inside the container's rootfs. See the GitHub Security Advisory for the maintainer's analysis.

Attack Vector

An attacker with the ability to run or influence a container on a node with a vulnerable cri-o version places a malicious symlink inside the container filesystem. The symlink targets a sensitive host path using directory traversal. When cri-o performs file operations that dereference the symlink, the runtime reads or writes on the host filesystem with runtime privileges. Refer to the Red Hat CVE-2024-5154 advisory for exploitation preconditions.

Detection Methods for CVE-2024-5154

Indicators of Compromise

Symbolic links inside container image layers or running containers whose targets contain ../ sequences or absolute paths outside the container rootfs.
Unexpected modifications to host paths such as /etc, /var/lib/kubelet, /var/lib/containers, or /root on nodes running cri-o.
cri-o audit or journal entries showing file operations that resolve to paths outside the expected container storage directory.

Detection Strategies

Inventory nodes and identify running cri-o versions; flag any host running 1.28.6, 1.29.4, or 1.30.0 for prioritized patching.
Scan container images and running workloads for symlinks whose resolved target lies outside the container root using tools such as find / -type l -lname '*../*'.
Correlate Kubernetes admission and pod lifecycle events with node-level file integrity monitoring to catch traversal attempts during container start or exec.

Monitoring Recommendations

Enable file integrity monitoring on host directories owned by root and the container runtime, including /etc, /var/lib/cni, and kubelet credential paths.
Forward cri-o and kubelet logs to a central logging platform and alert on repeated symlink or path errors during container operations.
Monitor for anomalous container behaviors such as workloads that create symlinks pointing to root-owned paths shortly after start.

How to Mitigate CVE-2024-5154

Immediate Actions Required

Upgrade cri-o to a fixed release referenced in the GitHub Security Advisory GHSA-j9hf-98c3-wrm8 on every Kubernetes node.
Apply the relevant Red Hat errata for OpenShift Container Platform and RHEL, including RHSA-2024:3676, RHSA-2024:3700, RHSA-2024:4008, and RHSA-2024:4486.
Rotate any secrets, service account tokens, or credentials that were mounted on nodes running an unpatched cri-o version.

Patch Information

Upstream fixes for cri-o are documented in GitHub Security Advisory GHSA-j9hf-98c3-wrm8. Red Hat customers should install the packages shipped in the following errata: RHSA-2024:3676, RHSA-2024:3700, RHSA-2024:4008, RHSA-2024:4159, RHSA-2024:4486, and RHSA-2024:10818. Additional context is available in the Red Hat CVE-2024-5154 page.

Workarounds

Restrict who can create or run pods on affected nodes using Kubernetes Role-Based Access Control (RBAC) and admission controllers until patching is complete.
Enforce restrictive Pod Security Standards and disallow privileged containers, hostPath volumes, and unnecessary capabilities that increase blast radius.
Use trusted, signed container images only and block deployment of images from unknown registries via admission policy.

bash

# Verify cri-o version on each node and confirm it is not one of the vulnerable releases
crio --version
# Example vulnerable outputs: 1.28.6, 1.29.4, 1.30.0

# Update cri-o on Red Hat-based nodes after applying the relevant RHSA
sudo dnf update cri-o
sudo systemctl restart crio