Date: Wed, 15 Jul 2020 09:04:24 -0600 From: Joel Smith <joelsmith@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2020-8557: Kubernetes: Node disk DOS by writing to container /etc/hosts Hello Open Source Community, A security issue was discovered in kubelet that could result in the Denial of Service of a node if a pod can write to its own /etc/hostsfile. This issue has been rated Medium (5.5, _CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/CR:H/IR:H/AR:M_ <https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/CR:H/IR:H/AR:M>), and assigned CVE-2020-8557. The /etc/hostsfile mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hostsfile, it could fill the storage space of the node and cause the node to fail. *Am I vulnerable?* Any clusters allowing pods with sufficient privileges to write to their own /etc/hostsfiles are affected. This includes containers running with CAP_DAC_OVERRIDEin their capabilities bounding set (true by default) and either UID 0 (root) or a security context with allowPrivilegeEscalation: true(true by default). *Affected Versions* * kubelet v1.18.0-1.18.5 * kubelet v1.17.0-1.17.8 * kubelet < v1.16.13 *How do I mitigate this vulnerability?* PodSecurityPolicies or other admission webhooks could be employed to force containers to drop CAP_DAC_OVERRIDEor disallow running as root or with privilege escalation, but these measures may break existing workloads that rely upon these privileges to function properly. *Fixed Versions* * kubelet v1.19.0 * kubelet v1.18.6 * kubelet v1.17.9 * kubelet v1.16.13 To upgrade, refer to the documentation: _https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster_ *Detection* Large pod etc-hostsfiles may indicate that a pod is attempting to perform a Denial of Service attack using this bug. A command such as find /var/lib/kubelet/pods/*/etc-hosts -size +1M run on a node can be used to find abnormally large pod etc-hostsfiles. *Additional Details* See the GitHub issue for more details: _https://github.com/kubernetes/kubernetes/issues/93032_ *Acknowledgements* This vulnerability was reported by Kebe Liu of DaoCloud Thank you, Joel Smith on behalf of the Kubernetes Product Security Committee
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.