Medium severity · published Mar 13, 2025
CVE-2024-9042
This CVE affects only Windows worker nodes
5.9
CVSS
1.4%
EPSS
No
On KEV
Description
This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KU
Kubelet · Kubernetes
<=v1.29.12; v1.30 through v1.30.8; v1.31 through v1.31.4; v1.32 through v1.32.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9042
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9042
github.com
https://github.com/kubernetes/kubernetes/issues/129654
groups.google.com
https://groups.google.com/g/kubernetes-security-announce/c/9C3vn6aCSVg
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/01/16/1
More from Kubelet
8.8
CVE-2023-5528
Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
8.8
CVE-2023-3955
Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
8.8
CVE-2023-3676
Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
8.1
CVE-2024-10220
Arbitrary command execution through gitRepo volume
6.5
CVE-2025-1767
This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node