Security readout for executives and security teams
Plain-English summary
An OpenShift build pod can access a node’s private image-pull credentials through a writable file mount. A low-privileged attacker who can control the relevant build process could alter those credentials, disrupting new image pulls, and could potentially expose secrets. This may interrupt deployments and services that depend on pulling container images.
Executive priority
Prioritize remediation for clusters permitting tenant, developer, or automation-controlled Docker builds. Credential exposure could require secret rotation, while credential modification could block deployments and recovery operations. Treat suspicious image-pull failures as a potential security event. Internet exposure alone does not establish exploitability; build permissions and update status are the decisive factors.
Technical view
The docker-build container mounts the node’s /var/lib/kubelet/config.json through hostPath without read-only enforcement. Because the mounted credential file is writable, an attacker with low privileges can modify it, affecting confidentiality and integrity and causing high availability impact. The supplied CVSS 3.1 score is 7.6, with no user interaction required.
Likely exposure
Exposure centers on affected OpenShift Container Platform environments where untrusted or compromised low-privileged users can control relevant Docker builds. The bundle identifies affected entries across versions 4.12 through 4.19, but exact exposure and corrected package boundaries should be confirmed against the applicable Red Hat advisory.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Exploitation requires low privileges but no user interaction, according to the supplied CVSS vector. The attacker must reach and influence the affected OpenShift build workflow; this is not described as unauthenticated compromise.
Researcher notes
The weakness maps to CWE-732 because a sensitive host credential file receives unsafe write access inside a build container. The supplied affected-product entries span 4.12–4.19 and contain varied package mappings. They do not clearly identify all fixed versions, so validate precise applicability and remediation builds through Red Hat’s CVE page and release-specific errata.
Mitigation direction
- Apply the Red Hat security update applicable to the deployed OpenShift release.
- Confirm corrected package versions using Red Hat’s CVE page and corresponding errata.
- Restrict Docker build creation and administration to trusted identities until remediation is verified.
- Pause untrusted Docker builds where immediate updating is not possible.
- Rotate node image-pull credentials if unauthorized access or modification is suspected.
Validation and detection
- Inventory OpenShift versions and compare installed packages with the applicable Red Hat errata.
- Inspect Docker build pod specifications for a writable mount of /var/lib/kubelet/config.json.
- Verify the relevant security updates are installed across every cluster and node pool.
- Review audit records for suspicious builds or access involving node pull credentials.
- Investigate unexpected image-pull failures and unauthorized changes to node credential files.
- Confirm nodes can pull required private images after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-732: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-45497 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H2.84.7redhatVulnerability scoring details
Base CVSS 3.1 score
7.6HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2025:10270CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:10294CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:10747CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9269CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9278CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9562CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9759CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9765CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-45497CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2308673CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Permission Assignment for Critical Resource
Incorrect Permission Assignment for Critical Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.