CVE-2024-12401

Vulnerability

Overview

CVE-2024-12401 is a denial-of-service (DoS) vulnerability in the cert-manager package. The flaw arises from inefficient processing of PEM data that cert-manager reads from resources such as Secret objects. An attacker who can modify this PEM data can trigger excessive CPU consumption in the cert-manager controller pod, effectively creating a DoS condition [1][2].

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must have the ability to modify PEM data that cert-manager reads. This typically requires write access to Secret resources or other data sources that cert-manager monitors. The attacker does not need network-level access to the controller pod itself; instead, they can leverage existing permissions within the Kubernetes cluster to alter the data. No authentication beyond standard Kubernetes RBAC is required, but the attacker must be able to create or update resources that cert-manager processes [1][2].

Impact

Successful exploitation leads to high CPU usage by the cert-manager controller pod, which can degrade or completely disrupt certificate management operations. This may prevent the issuance, renewal, or revocation of TLS certificates, impacting the security and availability of services that rely on cert-manager. The DoS condition is limited to the controller pod and does not directly affect other cluster components, but it can cause cascading failures if certificate operations are critical [1][2].

Mitigation

Red Hat has acknowledged this issue and recommends updating cert-manager to a patched version. As of the publication date, no workaround is documented. Users should review the advisory from Red Hat and apply the appropriate update to mitigate the risk [1][2].