Ansible community.general: memcached fact cache unpickles values, giving code execution on the controller

Impact

The memcached cache plugin documents JSON storage but performs no explicit serialization, so python-memcached pickles on write and unpickles on read. Anyone who can write to the memcached instance backing the fact cache can plant a pickle payload that executes on the Ansible controller the next time that host's facts are read. On a GPU fleet the controller is usually the box that holds SSH keys, BMC credentials and the playbooks that drive node provisioning, driver rollouts and firmware flashing, so controller code execution converts into fleet-wide reach rather than a single host. Memcached is unauthenticated and the cache keys are predictable, so no prior foothold on the controller is needed.

Who can reach it

Anyone who can reach the memcached instance used as the Ansible fact cache - unauthenticated, since memcached has no auth and the cache keys are derived predictably from inventory host names. Exploitation requires the cache to be network-exposed or shared with other workloads; a memcached bound to loopback on the controller only is not reachable.

What to do

Red Hat's advisory does not name a fixed collection version in this record. What is actionable now: move fact_caching off the memcached plugin (jsonfile, or a backend with authentication), or bind the memcached instance to loopback and keep it off any shared network, and flush the existing cache since a poisoned entry survives the config change. This is a controller-side configuration change and a collection update - no GPU node drain or reboot is involved. Track the Red Hat CVE page for the fixed community.general build.

References

Related entries

• GlusterFS (glusterd, auth.allow): The auth.allow option does not actually restrict who may connect, so anyCVE-2018-1112 · GlusterFS (glusterd, auth.allow)High
• Altair PBS Professional / OpenPBS (pbs_mom): Pbs_mom, the daemon that executes jobs on every compute node, acceptsCVE-2019-15719 · Altair PBS Professional / OpenPBS (pbs_mom)High
• Ceph MON / MGR (ceph-mon, ceph-mgr): Ceph-mon and ceph-mgr fail to enforce the caps on an authenticated principal, so aCVE-2020-10736 · Ceph MON / MGR (ceph-mon, ceph-mgr)High
• Eaton Intelligent Power Manager (IPM) prior to 1.69 - meta_driver_srv.js: Unauthenticated arbitrary file deletionCVE-2021-23279 · Eaton Intelligent Power Manager (IPM) prior to 1.69 - meta_driver_srv.jsHigh
• Intel Data Center Manager: Improper neutralisation (injection) in Data Center Manager lets an authenticated userCVE-2022-21225 · Intel Data Center ManagerHigh
• Schneider Electric Data Center Expert (versions prior to v7.9.0) - credential storage: DCE stores device passwordsCVE-2022-32519 · Schneider Electric Data Center Expert (versions prior to v7.9.0) - credential storageHigh