CVE-2024-10975 - Vulnerability Details

Link	Providers
https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.
Title		Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission
Weaknesses		CWE-863
References		https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10975", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "state": "PUBLISHED", "assignerShortName": "HashiCorp", "dateReserved": "2024-11-07T19:05:40.525Z", "datePublished": "2024-11-07T21:04:43.804Z", "dateUpdated": "2024-11-07T21:22:50.668Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Nomad", "repo": "https://github.com/hashicorp/nomad", "vendor": "HashiCorp", "versions": [{"lessThan": "1.9.2", "status": "affected", "version": "1.3.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Nomad Enterprise", "repo": "https://github.com/hashicorp/nomad", "vendor": "HashiCorp", "versions": [{"changes": [{"at": "1.8.7", "status": "unaffected"}, {"at": "1.7.15", "status": "unaffected"}], "lessThan": "1.9.2", "status": "affected", "version": "1.3.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Nomad Community and Nomad Enterprise (\"Nomad\") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.</p><br/>"}], "value": "Nomad Community and Nomad Enterprise (\"Nomad\") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV3_1": {"baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-11-07T21:05:58.564Z"}, "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission"}], "source": {"advisory": "HCSEC-2024-27", "discovery": "INTERNAL"}, "title": "Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-07T21:22:29.026938Z", "id": "CVE-2024-10975", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T21:22:50.668Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-10975 (string)

assignerOrgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

state : PUBLISHED (string)

assignerShortName : HashiCorp (string)

dateReserved : 2024-11-07T19:05:40.525Z (string)

datePublished : 2024-11-07T21:04:43.804Z (string)

dateUpdated : 2024-11-07T21:22:50.668Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

product : Nomad (string)

repo : https://github.com/hashicorp/nomad (string)

vendor : HashiCorp (string)

versions : [ »

0 : { »

lessThan : 1.9.2 (string)

status : affected (string)

version : 1.3.0 (string)

versionType : semver (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

product : Nomad Enterprise (string)

repo : https://github.com/hashicorp/nomad (string)

vendor : HashiCorp (string)

versions : [ »

0 : { »

changes : [ »

0 : { »

at : 1.8.7 (string)

status : unaffected (string)

}

1 : { »

at : 1.7.15 (string)

status : unaffected (string)

}

]

lessThan : 1.9.2 (string)

status : affected (string)

version : 1.3.0 (string)

versionType : semver (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. (string)

}

]

value : Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-1 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

baseScore : 7.7 (number)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

shortName : HashiCorp (string)

dateUpdated : 2024-11-07T21:05:58.564Z (string)

}

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission (string)

}

]

source : { »

advisory : HCSEC-2024-27 (string)

discovery : INTERNAL (string)

}

title : Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-11-07T21:22:29.026938Z (string)

id : CVE-2024-10975 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-07T21:22:50.668Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10975", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-07T21:22:29.026938Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T21:22:36.855Z"}}], "cna": {"title": "Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission", "source": {"advisory": "HCSEC-2024-27", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/hashicorp/nomad", "vendor": "HashiCorp", "product": "Nomad", "versions": [{"status": "affected", "version": "1.3.0", "lessThan": "1.9.2", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}, {"repo": "https://github.com/hashicorp/nomad", "vendor": "HashiCorp", "product": "Nomad Enterprise", "versions": [{"status": "affected", "changes": [{"at": "1.8.7", "status": "unaffected"}, {"at": "1.7.15", "status": "unaffected"}], "version": "1.3.0", "lessThan": "1.9.2", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission"}], "descriptions": [{"lang": "en", "value": "Nomad Community and Nomad Enterprise (\"Nomad\") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.", "supportingMedia": [{"type": "text/html", "value": "<p>Nomad Community and Nomad Enterprise (\"Nomad\") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15.</p><br/>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-11-07T21:05:58.564Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10975", "state": "PUBLISHED", "dateUpdated": "2024-11-07T21:22:50.668Z", "dateReserved": "2024-11-07T19:05:40.525Z", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "datePublished": "2024-11-07T21:04:43.804Z", "assignerShortName": "HashiCorp"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-10975 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-07T21:22:29.026938Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-07T21:22:36.855Z (string)

}

]

cna : { »

title : Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission (string)

source : { »

advisory : HCSEC-2024-27 (string)

discovery : INTERNAL (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-1 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 7.7 (number)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

repo : https://github.com/hashicorp/nomad (string)

vendor : HashiCorp (string)

product : Nomad (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.3.0 (string)

lessThan : 1.9.2 (string)

versionType : semver (string)

}

]

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

defaultStatus : unaffected (string)

}

1 : { »

repo : https://github.com/hashicorp/nomad (string)

vendor : HashiCorp (string)

product : Nomad Enterprise (string)

versions : [ »

0 : { »

status : affected (string)

changes : [ »

0 : { »

at : 1.8.7 (string)

status : unaffected (string)

}

1 : { »

at : 1.7.15 (string)

status : unaffected (string)

}

]

version : 1.3.0 (string)

lessThan : 1.9.2 (string)

versionType : semver (string)

}

]

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-863 (string)

description : CWE-863: Incorrect Authorization (string)

}

]

}

]

providerMetadata : { »

orgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

shortName : HashiCorp (string)

dateUpdated : 2024-11-07T21:05:58.564Z (string)

}

cveMetadata : { »

cveId : CVE-2024-10975 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-07T21:22:50.668Z (string)

dateReserved : 2024-11-07T19:05:40.525Z (string)

assignerOrgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

datePublished : 2024-11-07T21:04:43.804Z (string)

assignerShortName : HashiCorp (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Nomad Community and Nomad Enterprise (\"Nomad\") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15."}, {"lang": "es", "value": "La especificaci\u00f3n de vol\u00famenes de Nomad Community y Nomad Enterprise (\"Nomad\") es vulnerable a la creaci\u00f3n arbitraria de vol\u00famenes entre espacios de nombres mediante escrituras no autorizadas en vol\u00famenes de la Interfaz de almacenamiento de contenedores (CSI). Esta vulnerabilidad, identificada como CVE-2024-10975, se ha corregido en Nomad Community Edition 1.9.2 y Nomad Enterprise 1.9.2, 1.8.7 y 1.7.15."}], "id": "CVE-2024-10975", "lastModified": "2024-11-08T19:01:03.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security@hashicorp.com", "type": "Secondary"}]}, "published": "2024-11-07T21:15:06.383", "references": [{"source": "security@hashicorp.com", "url": "https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission"}], "sourceIdentifier": "security@hashicorp.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@hashicorp.com", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Nomad Community and Nomad Enterprise ("Nomad") volume specification is vulnerable to arbitrary cross-namespace volume creation through unauthorized Container Storage Interface (CSI) volume writes. This vulnerability, identified as CVE-2024-10975, is fixed in Nomad Community Edition 1.9.2 and Nomad Enterprise 1.9.2, 1.8.7, and 1.7.15. (string)

}

1 : { »

lang : es (string)

value : La especificación de volúmenes de Nomad Community y Nomad Enterprise ("Nomad") es vulnerable a la creación arbitraria de volúmenes entre espacios de nombres mediante escrituras no autorizadas en volúmenes de la Interfaz de almacenamiento de contenedores (CSI). Esta vulnerabilidad, identificada como CVE-2024-10975, se ha corregido en Nomad Community Edition 1.9.2 y Nomad Enterprise 1.9.2, 1.8.7 y 1.7.15. (string)

}

]

id : CVE-2024-10975 (string)

lastModified : 2024-11-08T19:01:03.880 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.7 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.1 (number)

impactScore : 4 (number)

source : security@hashicorp.com (string)

type : Secondary (string)

}

]

}

published : 2024-11-07T21:15:06.383 (string)

references : [ »

0 : { »

source : security@hashicorp.com (string)

url : https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission (string)

}

]

sourceIdentifier : security@hashicorp.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-863 (string)

}

]

source : security@hashicorp.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object