{"id":144093,"date":"2025-10-04T05:11:54","date_gmt":"2025-10-04T03:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera"},"modified":"2025-10-04T05:11:54","modified_gmt":"2025-10-04T03:11:54","slug":"uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans Red Hat OpenShift AI, permettant un acc\u00e8s root aux n\u0153uds du cluster","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dans la plateforme OpenShift AI Service, qui permet d'organiser le fonctionnement d'un cluster pour l'ex\u00e9cution et l'entra\u00eenement de mod\u00e8les d'IA, une vuln\u00e9rabilit\u00e9 (CVE-2025-10725) a \u00e9t\u00e9 d\u00e9couverte, permettant \u00e0 un utilisateur non privil\u00e9gi\u00e9 d'obtenir des droits d'administrateur du cluster. Apr\u00e8s une attaque r\u00e9ussie, l'attaquant a la possibilit\u00e9 de contr\u00f4ler le cluster, d'acc\u00e9der enti\u00e8rement \u00e0 tous les services, donn\u00e9es et applications ex\u00e9cut\u00e9es dans le cluster, ainsi que d'avoir un acc\u00e8s root aux n\u0153uds du cluster. <\/p>\n

Pour mener une attaque, il suffit d'un acc\u00e8s authentifi\u00e9 non privil\u00e9gi\u00e9 \u00e0 la plateforme, par exemple, un chercheur connect\u00e9 \u00e0 OpenShift AI utilisant un notebook Jupyter pourrait effectuer l'attaque. Le probl\u00e8me a \u00e9t\u00e9 class\u00e9 comme critique \u2014 9,9 sur 10. <\/p>\n

La vuln\u00e9rabilit\u00e9 est caus\u00e9e par une attribution incorrecte du r\u00f4le \u00ab kueue-batch-user-role \u00bb, qui a \u00e9t\u00e9 accidentellement li\u00e9 au groupe \u00ab system:authenticated \u00bb, permettant \u00e0 tout utilisateur du service de cr\u00e9er un travail (OpenShift Job) dans n'importe quel espace de noms. Entre autres, tout utilisateur pouvait cr\u00e9er un travail dans l'espace de noms privil\u00e9gi\u00e9 \u00ab openshift-apiserver-operator \u00bb et configurer son ex\u00e9cution avec les privil\u00e8ges du ServiceAccount. <\/p>\n

Dans l'environnement d'ex\u00e9cution du code avec les privil\u00e8ges de ServiceAccount, un jeton d'acc\u00e8s avec des droits de ServiceAccount est disponible, que l'attaquant pourrait extraire et utiliser pour compromettre des comptes plus privil\u00e9gi\u00e9s. Au final, l'attaque pouvait \u00eatre pouss\u00e9e jusqu'\u00e0 obtenir un acc\u00e8s root aux n\u0153uds principaux, apr\u00e8s quoi l'attaquant pouvait avoir un contr\u00f4le complet sur tout le contenu du cluster.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 OpenShift AI Service, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f AI-\u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-10725), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u043e\u043c, \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a\u043e \u0432\u0441\u0435\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c, \u0434\u0430\u043d\u043d\u044b\u043c \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u043c \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c, \u0430 \u0442\u0430\u043a\u0436\u0435 root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0437\u043b\u0430\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043b\u044e\u0431\u043e\u0433\u043e \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-144093","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans Red Hat OpenShift AI, permettant un acc\u00e8s root aux n\u0153uds du cluster | ProHoster","description":"Dans la plateforme OpenShift AI Service, qui permet d'organiser le fonctionnement d'un cluster pour l'ex\u00e9cution et l'entra\u00eenement de mod\u00e8les d'IA, une vuln\u00e9rabilit\u00e9 (CVE-2025-10725) a \u00e9t\u00e9 d\u00e9couverte, permettant \u00e0 un utilisateur non privil\u00e9gi\u00e9 d'obtenir des droits.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Red Hat OpenShift AI, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0437\u043b\u0430\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 OpenShift AI Service, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438 \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f AI-\u043c\u043e\u0434\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-10725), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-red-hat-openshift-ai-dopuskayushhaya-root-dostup-k-uzlam-klastera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-04T03:11:54+00:00","article:modified_time":"2025-10-04T03:11:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"144093","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 15:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:07:19","updated":"2026-01-23 15:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/144093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=144093"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/144093\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=144093"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=144093"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=144093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}