CVE-2024-3154: 
cAdvisor vulnerability analysis and mitigation

A security vulnerability (CVE-2024-3154) was discovered in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. The vulnerability was disclosed on April 26, 2024, affecting cri-o versions prior to 1.30.0, 1.29.4, 1.28.6, and 1.27.6. Any user who can create a pod with an arbitrary annotation may perform arbitrary actions on the host system (GitHub Advisory, NVD).

The vulnerability exists in CRI-O's handling of pod annotations, where it passes pod annotations directly to OCI annotations without proper filtering. Specifically, annotations with the prefix 'org.systemd.property.' can be used to inject arbitrary systemd properties. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (High) (Red Hat Advisory).

The vulnerability allows any user with the ability to create pods to perform arbitrary actions on the host system through systemd property injection. This could potentially lead to system compromise or unauthorized actions at the host level (GitHub Advisory).

The vulnerability can be exploited by creating a pod with specific annotations that inject systemd properties. A proof of concept exists demonstrating the injection of arbitrary systemd properties through pod annotations, such as using 'org.systemd.property.SuccessAction' (GitHub Advisory).

The vulnerability has been fixed in cri-o versions 1.30.0, 1.29.4, 1.28.6, and 1.27.6. Users are advised to upgrade to these patched versions. Unfortunately, the only workaround for unpatched systems would involve implementing an external mutating webhook to disallow these annotations (GitHub Advisory).