CVE-2020-8557GHSA-55QJ-GJ3X-JQ9RGO-2024-2753
Kubernetes node disk Denial of Service by writing to container /etc/hosts
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.18.6, 1.17.9, 1.16.13
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
Timeline
- CVE published
- Record last updated
Affected versions
- Kubernetes Kubernetes
From 1.18 · fixed in 1.18.6; From 1.17 · fixed in 1.17.9; From 1.16 · fixed in 1.16.13
- k8s.io/kubernetes/pkg/kubeletGo
From 1.1.0 · fixed in 1.16.13
- k8s.io/kubernetes/pkg/kubeletGo
From 1.17.0 · fixed in 1.17.9
- k8s.io/kubernetes/pkg/kubeletGo
From 1.18.0 · fixed in 1.18.6
- k8s.io/kubernetesGo
From 1.1.0 · fixed in 1.16.13; From 1.17.0 · fixed in 1.17.9; From 1.18.0 · fixed in 1.18.6