Kubernetes node setting allows for neighboring hosts to bypass localhost boundary
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.18.4, 1.17.7, 1.16.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 2 proofs of concept on GitHub
Summary
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.
Timeline
- CVE published
- Record last updated
Affected versions
- Kubernetes Kubernetes
prior to 1.18.4, prior to 1.17.7, prior to 1.16.11, 1.15, 1.14, 1.13, 1.12, 1.11, 1.10, 1.9, 1.8, 1.7, 1.6, 1.5, 1.4, 1.3, 1.2, 1.1
- k8s.io/kubernetesGo
From 1.18.0 · fixed in 1.18.4
- k8s.io/kubernetesGo
From 1.17.0 · fixed in 1.17.7
- k8s.io/kubernetesGo
fixed in 1.16.11
- k8s.io/kubernetesGo
fixed in 1.16.11; From 1.17.0 · fixed in 1.17.7; From 1.18.0 · fixed in 1.18.4