CVE-2024-5321 is a vulnerability in the windows-machine-config-operator-container component of Red Hat OpenShift for Windows Containers 7.2.2. It involves incorrect permissions set on Windows container logs, which could lead to unauthorized access to log data. Red Hat has issued a security advisory (RHSA-2024:6734) describing this issue and providing an updated product release that includes the fix. The advisory rates the security impact as moderate but does not provide a CVSS score. The fix is included in the updated windows-machine-config-operator and windows-machine-config-operator-bundle packages. The advisory references upgrade documentation for the Windows Machine Config Operator to apply the fix.

The vulnerability allows for incorrect permissions on Windows container logs, which may lead to unauthorized access to potentially sensitive information contained in those logs. The impact is rated moderate by Red Hat. There is no indication of active exploitation in the wild. The issue could affect confidentiality of log data within Windows container workloads deployed via Red Hat OpenShift for Windows Containers.

Red Hat has released an updated product version 7.2.2 of OpenShift for Windows Containers that includes fixes for CVE-2024-5321. Users should upgrade to this version following the Windows Machine Config Operator upgrade documentation provided by Red Hat at https://docs.openshift.com/container-platform/latest/windows_containers/windows-node-upgrades.html. This update addresses the incorrect permissions issue on Windows container logs. No additional mitigation steps are indicated or required beyond applying the official update.