Описание
A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to escalate privileges or perform unauthorized actions if another vulnerability is exploited within the root-run process.
Отчет
This issue has a Low impact on Red Hat products. Tekton task steps in Konflux run as root without sufficient defense-in-depth security context hardening. While this does not directly grant unauthorized access, it could potentially facilitate privilege escalation if an attacker has already compromised a Tekton task, making it easier to bypass security controls.
Меры по смягчению последствий
To mitigate this issue, configure Tekton tasks within Konflux to apply defense-in-depth securityContext hardening. For tasks that genuinely require root privileges, explicitly drop all unnecessary capabilities by adding capabilities.drop: [ALL] alongside add: [SETFCAP], set allowPrivilegeEscalation: false, configure seccompProfile.type: RuntimeDefault, and enable readOnlyRootFilesystem: true with explicit emptyDir mounts for scratch paths. For tasks that do not require root, such as oras steps, remove runAsUser: 0 from the task definition. These changes require modifying the Tekton task definitions and reapplying them, which may involve restarting affected pods or pipelines.
Дополнительная информация
Статус:
2.6 Low
CVSS3
2.6 Low
CVSS3