Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

Date: Wed, 15 Jul 2020 09:09:07 -0700
From: Tim Allclair <tallclair@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Kubernetes: CVE-2020-8559: Privilege escalation from compromised node
 to cluster

A security issue was discovered in the kube-apiserver that could enable a
privilege escalation from a compromised node.

This issue has been rated Medium (
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H>),
and assigned CVE-2020-8559.

If an attacker is able to intercept certain requests to the Kubelet, they
can send a redirect response that may be followed by a client using the
credentials from the original request. This can lead to compromise of other
nodes.

If multiple clusters share the same certificate authority trusted by the
client, and the same authentication credentials, this vulnerability may
allow an attacker to redirect the client to another cluster. In this
configuration, this vulnerability should be considered High severity.
Am I vulnerable?

You are only affected by this vulnerability if you treat the node as a
security boundary, or if clusters share certificate authorities and
authentication credentials.

Note that this vulnerability requires an attacker to first compromise a
node through separate means.
Affected Versions

   -

   kube-apiserver v1.18.0-1.18.5
   -

   kube-apiserver v1.17.0-1.17.8
   -

   kube-apiserver v1.16.0-1.16.12
   -

   all kube-apiserver versions prior to v1.16.0

How do I mitigate this vulnerability?

To mitigate this vulnerability you must upgrade the kube-apiserver to a
patched version.
Fixed Versions

   -

   kube-apiserver v1.18.6
   -

   kube-apiserver v1.17.9
   -

   kube-apiserver v1.16.13

Fix impact: Proxied backends (such as an extension API server) that respond
to upgrade requests with a non-101 response code may be broken by this
patch.

To upgrade, refer to the documentation:
https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster
Detection

Upgrade requests should never respond with a redirect. If any of the
following requests have a response code in the 300-399 range, it may be
evidence of exploitation. This information can be found in the Kubernetes
audit logs.

   -

   pods/exec
   -

   pods/attach
   -

   pods/portforward
   -

   any resource: proxy

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io
Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/92914
Acknowledgements

This vulnerability was reported by Wouter ter Maat of Offensi, via the
Kubernetes bug bounty.

Thank You,

Tim Allclair on behalf of the Kubernetes Product Security Committee

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.