CVE-2022-27652

cri-o: Default inheritable capabilities for linux container should be empty

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Kubernetes Mobyproject and 1 more

Products

Fedora Cri-o Moby and 2 more

CVE-2022-1708

cri-o: memory exhaustion on the node when access to the kube api

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Fedoraproject Kubernetes Redhat

Products

Fedora Cri-o Enterprise Linux and 2 more

CVE-2022-0811

CRI-O: Arbitrary code execution in cri-o via abusing “kernel.core_pattern” kernel parameter

A flaw was found in CRI-O in the way it set kernel options for a pod. This issue allows anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime to achieve a container escape and arbitrary code execution as root on the cluster node, where the malicious pod was deployed.

CVSS 3.1 · 8.8 High EPSS 19.0% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Cri-o Openshift

CVE-2022-0532

cri-o: pod with access to 'hostIPC' and 'hostNetwork' kernel namespace allows sysctl from the list of safe sysctls to be applied to the host

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Cri-o Openshift Openshift Container Platform

CVE-2021-25746

Ingress-nginx directive injection via annotations

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

CVSS 3.1 · 7.6 High EPSS 1.4% KEV · Not listed

Vendors

Kubernetes

Products

Ingress-nginx

CVE-2021-25745

Ingress-nginx path can be pointed to service account token file

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

CVSS 3.1 · 7.6 High EPSS 1.2% KEV · Not listed

Vendors

Kubernetes

Products

Ingress-nginx

CVE-2021-25742

Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

CVSS 3.1 · 7.6 High EPSS 2.1% KEV · Not listed

Vendors

Kubernetes Netapp

Products

Ingress-nginx Trident

CVE-2021-25741

Symlink Exchange Can Allow Host Filesystem Access

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

CVSS 3.1 · 8.8 High EPSS 8.0% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2021-25738

Code exec via yaml parsing

Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes

Products

Java

CVE-2021-25737

Holes in EndpointSlice Validation Enable Host Network Hijack

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

CVSS 3.1 · 2.7 Low EPSS 1.3% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2021-25735

Validating Admission Webhook does not observe some previous fields

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

CVSS 3.1 · 6.5 Medium EPSS 5.4% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8570

Kubernetes Java client libraries unvalidated path traversal in Copy implementation

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.

CVSS 3.1 · 9.1 Critical EPSS 3.7% KEV · Not listed

Vendors

Kubernetes

Products

Java

CVE-2020-8569

Kubernetes CSI snapshot-controller DoS

Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected.

CVSS 3.1 · 4.3 Medium EPSS 2.2% KEV · Not listed

Vendors

Kubernetes

Products

Container Storage Interface Snapshotter

CVE-2020-8568

Kubernetes Secrets Store CSI Driver sync/rotate directory traversal

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.

CVSS 3.1 · 5.8 Medium EPSS 1.3% KEV · Not listed

Vendors

Kubernetes

Products

Secrets Store Csi Driver

CVE-2020-8566

Ceph RBD adminSecrets exposed in logs when loglevel >= 4

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8565

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift Container Storage Openshift Data Foundation

CVE-2020-8564

Docker config secrets leaked when file is malformed and loglevel >= 4

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8563

Secret leaks in logs for vSphere Provider kube-controller-manager

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8559

Privilege escalation from compromised node to cluster

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

CVSS 3.1 · 6.4 Medium EPSS 6.1% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift

CVE-2020-8558

Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

CVSS 3.1 · 5.4 Medium EPSS 3.4% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Kubernetes Openshift