Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation

Summary

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.

Timeline

1. Dec 5, 2019, 4:05 PM UTCCVE published
2. Sep 16, 2024, 11:05 PM UTCRecord last updated

Affected versions

• Kubernetes kubernetes-csi external-provisioner

  From v1.14 · fixed in prior to 0.4.3

• Kubernetes kubernetes-csi external-snapshotter

  prior to 0.4.2, prior to 1.0.2, 1.1, prior to 1.2.2

• Kubernetes kubernetes-csi external-resizer

  0.1, 0.2

• github.com/kubernetes-csi/external-provisionerGo

  fixed in 0.4.3

• github.com/kubernetes-csi/external-provisionerGo

  From 1.0.0 · fixed in 1.0.2

• github.com/kubernetes-csi/external-provisionerGo

  1.1

• github.com/kubernetes-csi/external-provisionerGo

  From 1.2.0 · fixed in 1.2.2

• github.com/kubernetes-csi/external-provisionerGo

  From 1.3.0 · fixed in 1.3.1

• github.com/kubernetes-csi/external-snapshotter/v6Go

  From 1.0.0 · fixed in 1.0.2

• github.com/kubernetes-csi/external-snapshotter/v6Go

  1.1

• github.com/kubernetes-csi/external-snapshotter/v6Go

  From 1.2.0 · fixed in 1.2.2

• github.com/kubernetes-csi/external-resizerGo

  0.1

• github.com/kubernetes-csi/external-resizerGo

  0.2

References 7