Prevent CVE-2024-21626

other/block-proc-self-cve-2024-21626/block-proc-self-cve-2024-21626.yaml

@@ -0,0 +1,31 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: block-proc-self-cve-2024-21626
+spec:
+  validationFailureAction: Audit
+  rules:
+  - name: container-exec-block-proc-self
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod/exec
+          - Pod
+    validate:
+      message: "Pod {{ request.object.metadata.namespace }}/{{ request.object.metadata.name }} cannot use /proc/self/cwd, CVE-2024-21626"
+      deny:
+        conditions:
+          any:
+          - key: "{{ request.object.spec.containers[].args[] | contains(@, '/proc/self/cwd') }}"
+            operator: Equals
+            value: true
+          - key: "{{ request.object.spec.initContainers[].args[] | contains(@, '/proc/self/cwd') }}"
+            operator: Equals
+            value: true
+          - key: "{{ request.object.spec.ephemeralContainers[].args[] | contains(@, '/proc/self/cwd') }}"
+            operator: Equals
+            value: true
+          - key: "{{ request.object.command | contains(@, '/proc/self/cwd') }}"
+            operator: Equals
+            value: true

other/block-proc-self-mounting-cve-2024-21626/block-proc-self-mounting-cve-2024-21626.yaml

@@ -0,0 +1,49 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: block-proc-self-mounting-cve-2024-21626
+spec:
+  validationFailureAction: Enforce
+  rules:
+  - name: no-proc-self-images
+    match:
+      any:
+      - resources:
+          kinds:
+          - Pod
+    validate:
+      message: "Pod {{ request.object.metadata.namespace }}/{{ request.object.metadata.name }} with images having /proc/self/fd/ in their layers are not allowed CVE-2024-21626."
+      foreach:
+      - list: "request.object.spec.containers"
+        context:
+        - name: imageData
+          imageRegistry:
+            reference: "{{ element.image }}"
+        deny:
+          conditions:
+            any:
+              - key: "{{ imageData.configData.history[].created_by | contains(@, '/proc/self/fd/') }}"
+                operator: Equals
+                value: true
+      - list: "request.object.spec.initContainers"
+        context:
+        - name: imageData
+          imageRegistry:
+            reference: "{{ element.image }}"
+        deny:
+          conditions:
+            any:
+              - key: "{{ imageData.configData.history[].created_by | contains(@, '/proc/self/fd/') }}"
+                operator: Equals
+                value: true
+      - list: "request.object.spec.ephemeralContainers"
+        context:
+        - name: imageData
+          imageRegistry:
+            reference: "{{ element.image }}"
+        deny:
+          conditions:
+            any:
+              - key: "{{ imageData.configData.history[].created_by | contains(@, '/proc/self/fd/') }}"
+                operator: Equals
+                value: true

other/check-container-run-time-cve-2024-21626/check-container-run-time-cve-2024-21626.yaml

@@ -0,0 +1,34 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: check-container-run-time-cve-2024-21626
+spec:
+  validationFailureAction: audit
+  background: true
+  rules:
+  - name: container-run-time-version-outdated
+    match:
+      any:
+      - resources:
+          kinds:
+          - Node
+    context:
+    - name: cr_version
+      variable:
+        jmesPath: split(request.object.status.nodeInfo.containerRuntimeVersion, '://')[1]
+    - name: cr_runtime
+      variable:
+        jmesPath: split(request.object.status.nodeInfo.containerRuntimeVersion, '://')[0]
+    validate:
+      message: "Your container runtime is vulnerable to CVE-2024-21626 & CVE-2024-23651: {{cr_runtime}}:{{cr_version}}"
+      deny:
+        conditions:
+          any:
+          - key: |-
+              {{ cr_runtime == 'containerd' && semver_compare(cr_version, '<= 1.6.27') || false }}
+            operator: Equals
+            value: true
+          - key: |-
+              {{ cr_runtime == 'runc' && semver_compare(cr_version, '<= 1.1.11') || false }}
+            operator: Equals
+            value: true

other/disallow-proc-self-fd-workingdir-cve-2024-21626/disallow-proc-self-fd-workingdir-cve-2024-21626.yaml

@@ -0,0 +1,24 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-proc-self-fd-workingdir-cve-2024-21626
+spec:
+  validationFailureAction: Audit
+  background: true
+  rules:
+    - name: no-proc-self-fd-images
+      match:
+        any:
+        - resources:
+            kinds:
+              - Pod
+      validate:
+        message: "Using /proc/self/fd in workingDir is not allowed CVE-2024-21626."
+        pattern:
+          spec:
+            containers:
+              - =(workingDir): "!/proc/self/fd*"
+            initContainers:
+              - =(workingDir): "!/proc/self/fd*"
+            ephemeralContainers:
+              - =(workingDir): "!/proc/self/fd*"