Cloudanix VulnDB

CVE-2024-9594

Medium · 6.3

VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder

CVSS

6.3

EPSS

1.7%

Published

Oct 15, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A temporary login weakness during the creation of certain virtual-machine images could let an attacker who reaches the build computer slip changes into the images that later become Kubernetes servers.

Chainable
Exploitation
Supply Chain
Attacker needs
Local User
Complexity
High
Impact
Full Compromise
Component
Application
Class
Credential Exposure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Default credentials remain enabled on the build VM for Nutanix, OVA, QEMU and raw providers until the image build completes, allowing root login during that window.

Why it matters to the business

Organizations that built nodes from vulnerable images risk compromised Kubernetes clusters if an attacker reached the build environment while credentials were active; remediation requires rebuilding and replacing all affected node images.

How an attack unfolds

An attacker who can reach the image-builder VM during the build window authenticates with the enabled default credentials, escalates to root, and modifies the resulting VM image before it is finalized and deployed to Kubernetes nodes.

How to fix it

Upgrade kubernetes-sigs/image-builder to commit 09aedcd7e36cddacdb2d5ea7532003f39bf7bb57 or later and rebuild all node images created with the affected providers.

How to confirm the fix worked

Verify the image-builder commit or version used for each image; confirm no images were produced with versions <= v0.1.37 for the listed providers; re-test new images to ensure credentials are disabled at completion.

Typical attack path

  1. Gain network or host access to the image build VM while a build using Nutanix, OVA, QEMU or raw provider is running
  2. Authenticate using the default credentials that are temporarily enabled
  3. Obtain root privileges on the build VM
  4. Modify the disk image or injected artifacts before the build process disables the credentials and finalizes the image
  5. Deploy the altered image to Kubernetes nodes

How to detect it

Review build-host authentication logs, process execution history, and file-modification timestamps during the exact window each vulnerable image was being built; look for unexpected root sessions or changes to image contents after initial provisioning.

What your security team should do

  • Immediately identify and inventory all node images built with the vulnerable providers and versions
  • Rebuild and replace every affected image using the fixed commit
  • Restrict network access to image build VMs to only trusted build orchestration systems
  • Monitor build logs and VM access for unexpected root logins during image creation windows

The record

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/kubernetes-sigs/image-builder 0 0.1.38
SUSE:Linux Enterprise Module for Package Hub 15 SP5 govulncheck-vulndb 0 0.0.20241030T212825-150000.1.9.1
SUSE:Linux Enterprise Module for Package Hub 15 SP6 govulncheck-vulndb 0 0.0.20241030T212825-150000.1.9.1
SUSE:Package Hub 12 govulncheck-vulndb 0 0.0.20241104T154416-5.1
Ubuntu:20.04:LTS kubernetes 0 No fix
Ubuntu:22.04:LTS kubernetes 0 No fix
Ubuntu:24.04:LTS kubernetes 0 No fix
Ubuntu:24.10 kubernetes 0 No fix
Ubuntu:Pro:20.04:LTS kubernetes 0 No fix
openSUSE:Leap 15.5 govulncheck-vulndb 0 0.0.20241030T212825-150000.1.9.1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20241030T212825-150000.1.9.1
openSUSE:Tumbleweed govulncheck-vulndb 0 0.0.20241030T212825-1.1

Related vulnerabilities