CVE-2024-10975: Hashicorp Nomad Arbitrary Cross-Namespace Volume Creation Vulnerability
Summary
CVE-2024-10975: Hashicorp Nomad Incorrect Authorization vulnerability. Affects github.com/hashicorp/nomad versions < 1.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hashicorp Nomad is a flexible workload orchestrator that enables users to deploy and manage applications across various environments. It supports both containerized and non-containerized applications, providing features such as service discovery, load balancing, and resource management. However, a recent vulnerability has been identified in its volume specification, which allows unauthorized users to create volumes across namespaces, potentially leading to data breaches and unauthorized access.
Vulnerability Detail
The vulnerability, identified as CVE-2024-10975, arises from improper authorization checks in the Nomad volume specification. This flaw allows unauthorized Container Storage Interface (CSI) volume writes, enabling attackers to create arbitrary volumes in different namespaces. The implications of this vulnerability are significant, as it could lead to unauthorized data access, data manipulation, or service disruption. The vulnerability has been classified with a CVSS score of 7.7, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the CSI volume writes by implementing stricter access controls and ensuring that only authorized users have permission to create volumes within their namespaces.
Conclusion
The vulnerability CVE-2024-10975 in Hashicorp Nomad poses a significant risk due to its potential for unauthorized volume creation across namespaces. Users are strongly advised to update to the latest patched versions to mitigate this risk. Additionally, implementing stricter access controls can serve as a temporary workaround while updates are applied.
See every vulnerability recorded for github.com/hashicorp/nomad →
FAQ
CVE-2024-10975 is a vulnerability in Hashicorp Nomad that allows unauthorized users to create volumes across different namespaces due to improper authorization checks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized access to data, potential data manipulation, and disruption of services, which can lead to significant security risks.
You can update your Nomad installation by running 'go get github.com/hashicorp/nomad@v1.9.2' in your terminal to install the patched version.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in their software using just the Gopkg.lock file, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/nomad.
