CVE-2019-19354
📋 TL;DR
This vulnerability allows attackers with access to a container running the operator-framework/hadoop in Red Hat OpenShift 4 to modify the /etc/passwd file, potentially enabling privilege escalation. It affects OpenShift 4 deployments using the vulnerable operator-framework/hadoop component. Attackers need initial container access to exploit this flaw.
💻 Affected Systems
- Red Hat OpenShift Container Platform
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full container compromise leading to host escape, lateral movement within the cluster, and complete control of affected systems.
Likely Case
Privilege escalation within the container allowing unauthorized access to sensitive data and further exploitation of containerized applications.
If Mitigated
Minimal impact with proper container security controls, network segmentation, and least privilege principles in place.
🎯 Exploit Status
Exploitation requires existing container access. The vulnerability involves insecure file permissions allowing modification of /etc/passwd.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Red Hat advisories for specific patched versions
Vendor Advisory: https://access.redhat.com/articles/4859371
Restart Required: Yes
Instructions:
1. Update OpenShift 4 to the latest patched version. 2. Update operator-framework/hadoop component. 3. Restart affected containers and pods. 4. Verify the fix by checking /etc/passwd permissions.
🔧 Temporary Workarounds
Secure /etc/passwd permissions
linuxManually set secure permissions on /etc/passwd file within containers
chmod 644 /etc/passwd
chown root:root /etc/passwd
Container security context hardening
linuxApply security contexts to prevent privilege escalation
oc patch deployment <deployment-name> -p '{"spec":{"template":{"spec":{"securityContext":{"runAsNonRoot":true,"allowPrivilegeEscalation":false}}}}}'
🧯 If You Can't Patch
- Implement strict network policies to limit container-to-container communication
- Apply Pod Security Policies (PSP) or Security Context Constraints (SCC) to restrict container capabilities
🔍 How to Verify
Check if Vulnerable:
Check /etc/passwd file permissions within containers: ls -la /etc/passwd. Vulnerable if writable by non-root users.Check Version:
oc version && oc get pods -o json | grep imageVerify Fix Applied:
Verify /etc/passwd has permissions 644 and owned by root:root. Check container logs for unauthorized modifications.📡 Detection & Monitoring
Log Indicators:
- Unexpected modifications to /etc/passwd file
- Authentication failures or unusual user creation events
- Container privilege escalation attempts
Network Indicators:
- Unusual container-to-container communication patterns
- Lateral movement attempts within the cluster
SIEM Query:
source="container_logs" AND ("etc/passwd" OR "privilege escalation" OR "useradd")