Security readout for executives and security teams
Plain-English summary
CoreDNS can incorrectly cache a DNS response tied to the CD bit and later serve an invalid cached answer. For organizations using affected OpenShift or Red Hat ACM components, this is mainly a DNS trust and correctness issue, not a data theft or outage scenario in the supplied sources.
Executive priority
Prioritize during normal security maintenance, sooner for environments where DNS correctness directly affects routing, service discovery, or security controls. There is no supplied evidence of active exploitation or severe business disruption.
Technical view
The flaw is an incorrectly implemented caching behavior in CoreDNS. CVSS 3.1 is 5.3 with network attack vector, no privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact. Red Hat lists several OpenShift CoreDNS packages and ACM lighthouse-agent as affected.
Likely exposure
Confirmed exposure is in listed Red Hat OpenShift Container Platform 4.13 through 4.16 CoreDNS packages and Red Hat ACM lighthouse-agent. The bundle does not prove all upstream CoreDNS versions or non-Red Hat distributions are affected. Red Hat lists the OpenShift Logging Loki package as unaffected.
Exploitation context
The provided bundle marks KEV as false and contains no cited evidence of active exploitation. The CVSS vector indicates remote reachability without authentication, but the documented impact is limited to integrity of cached DNS responses.
Researcher notes
Focus analysis on CoreDNS cache handling of CD-bit responses and downstream package backports. Public issue and pull request references exist, but the bundle does not include a complete upstream affected-version range or detailed fixed-version mapping for every deployment.
Mitigation direction
- Apply relevant Red Hat errata for affected OpenShift and ACM components.
- Update affected CoreDNS-related container images through supported vendor channels.
- For non-Red Hat CoreDNS deployments, check upstream CoreDNS and vendor guidance.
- Treat DNS cache behavior changes as operationally sensitive and test before production rollout.
Validation and detection
- Inventory OpenShift and ACM versions against the affected product list.
- Confirm deployed CoreDNS package names match affected Red Hat package entries.
- Review vendor advisories to identify the fixed release applicable to each platform.
- Verify the OpenShift Logging Loki package is not incorrectly flagged as affected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-524: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-0874 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4redhatVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- Source timelineredhat
Made public.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2024:0041CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4850CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:6009CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:6406CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-0874CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2219234CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://github.com/coredns/coredns/issues/6186CVE reference, redhat
- https://github.com/coredns/coredns/pull/6354CVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Cache Containing Sensitive Information
Use of Cache Containing Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.