CVE-2024-7598

Published Mar 20, 2025

Last updated 6 months ago

CVSS low 3.1
Container Security

Overview

Description
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.
Source
jordan@liggitt.net
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
3.1
Impact score
1.4
Exploitability score
1.6
Vector string
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity
LOW

Weaknesses

jordan@liggitt.net
CWE-362

Social media

Hype score
Not currently trending

  1. CVE-2024-7598: Urgency of Fixing Network Restriction Bypass Flaws https://t.co/l0ZgWXT6eA #CVE2024 #Vulnerability #Microsoft

    @cyber_newsroom

    11 Jul 2026

    2 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2024-7598: Microsoft’s Race Condition Glosses Over Real Exploit Risks https://t.co/EtvoZ5qpjd #CVE20247598 #Microsoft #Cybersecurity

    @cyber_newsroom

    11 Jul 2026

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2024-7598: Microsoft Must Explain the Gaps in Network Restrictions https://t.co/X9KJVSVyhF #CVE2024 #MicrosoftSecurity #Cybersecurity

    @cyber_newsroom

    11 Jul 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CVE-2024-7598: Microsoft’s Opaque Vulnerability May Expose Critical Systems https://t.co/PsvNJG3RI8 #CVE2024 #MicrosoftSecurity #CyberSecurity

    @cyber_newsroom

    11 Jul 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2024-7598: Microsoft’s Namespace Termination Flaw Opens Unauthorized Access https://t.co/jOMxtOmiKu #CVE20247598 #MicrosoftSecurity #CyberSecurity

    @cyber_newsroom

    11 Jul 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. CVE-2024-7598: Race Condition Exposes Microsoft Networks to Bypass Attacks https://t.co/AeSPtEBIR2 #CVE2024 #Cybersecurity #Microsoft

    @cyber_newsroom

    11 Jul 2026

    0 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2025-14269
  2. The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to connect to an arbitrary AF_UNIX socket outside the shared workspace. This can expose data or host-side capabilities provided by the targeted socket.•CVE-2026-79994
  3. On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.•CVE-2026-77179
  4. containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.•CVE-2026-53495
  5. A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.•CVE-2026-78234

References

Sources include official advisories and independent security research.