CVE-2019-19352
📋 TL;DR
This vulnerability allows an attacker with access to a container running the vulnerable operator-framework/presto component in Red Hat OpenShift 4 to modify the /etc/passwd file, potentially leading to privilege escalation. It affects OpenShift 4 deployments using the vulnerable presto operator. The insecure modification flaw enables attackers to gain higher privileges within the container environment.
💻 Affected Systems
- Red Hat OpenShift Container Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full container compromise leading to cluster-level privilege escalation, data exfiltration, and lateral movement within the OpenShift environment.
Likely Case
Container-level privilege escalation allowing unauthorized access to sensitive data and resources within the compromised container.
If Mitigated
Limited impact with proper container security controls, network segmentation, and minimal privileges preventing effective exploitation.
🎯 Exploit Status
Exploitation requires existing container access. The vulnerability is in file permission handling within the container.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Red Hat advisories for specific patched versions
Vendor Advisory: https://access.redhat.com/security/cve/cve-2019-19352
Restart Required: Yes
Instructions:
1. Update OpenShift 4 to the latest patched version. 2. Update the presto operator to a secure version. 3. Restart affected containers and pods. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Container Security Hardening
linuxImplement strict container security policies to limit file system modifications
oc adm policy add-scc-to-user restricted -z default
Set readOnlyRootFilesystem: true in pod security context
File Permission Restrictions
linuxSet strict permissions on /etc/passwd within containers
chmod 644 /etc/passwd
chown root:root /etc/passwd
🧯 If You Can't Patch
- Implement strict network policies to isolate vulnerable containers from sensitive resources
- Apply least privilege principles and remove unnecessary capabilities from containers
🔍 How to Verify
Check if Vulnerable:
Check if running vulnerable OpenShift 4 version with presto operator. Review container permissions on /etc/passwd.Check Version:
oc versionVerify Fix Applied:
Verify OpenShift version is updated and /etc/passwd permissions are secure (644, root:root). Test privilege escalation attempts fail.📡 Detection & Monitoring
Log Indicators:
- Unexpected modifications to /etc/passwd file
- Privilege escalation attempts in container logs
- Unauthorized user creation in system logs
Network Indicators:
- Unusual outbound connections from presto containers
- Lateral movement attempts within cluster
SIEM Query:
source="container_logs" AND ("etc/passwd modification" OR "privilege escalation" OR "useradd")