CVE-2024-7625

What it actually does

The archive unpacking logic during allocation directory migration accepts multiple headers targeting the same file, permitting writes outside the intended allocation directory on the Nomad client.

Why it matters to the business

Attackers who already control a source client can tamper with files on other clients during job migrations, risking integrity of workloads and potential lateral movement within the orchestration environment.

How an attack unfolds

An attacker first obtains access to the Nomad client agent at the source allocation, then triggers or waits for an allocation migration that ships an archive containing duplicate headers for the same target file, causing the unpacker to write content outside the allocation directory on the destination client.

How to fix it

Upgrade HashiCorp Nomad to 1.6.14, 1.7.11, or 1.8.3. The listed podman packages on AlmaLinux 9 should be updated to 2:4.2.0-7.el9_1 where present in the environment.

How to confirm the fix worked

Confirm the running Nomad binary reports one of the fixed versions, review the archive unpacking code path for duplicate-header handling, and test migration of allocations containing crafted archives.

Typical attack path

1. Compromise the Nomad client agent at the source allocation
2. Trigger or observe an allocation migration event
3. Supply an archive whose headers reference the same file multiple times
4. Achieve unauthorized file writes on the destination client outside the allocation directory

How to detect it

Review Nomad client logs for allocation migration events, inspect file-system changes during migrations for writes outside expected directories, and correlate with source-client compromise indicators.

What your security team should do

• Prioritize upgrade of all Nomad clients and servers to the fixed releases
• Restrict access to Nomad client agents and monitor for anomalous migration activity
• Audit allocation migration logs for unexpected file operations outside allocation directories