[kOps Security Advisory] CVE-2023-1943: Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode

479 views
Skip to first unread message

CJ Cullen

unread,
Jun 21, 2023, 2:18:08 PM6/21/23
to kubernete...@googlegroups.com, d...@kubernetes.io, kubernetes-sec...@googlegroups.com, kubernetes-se...@googlegroups.com, distributo...@kubernetes.io, kubernetes+a...@discoursemail.com

Issue Details

A security issue was reported in kOps with the GCP Provider running in Gossip Mode, where Node service account credentials could be used by a container running in the cluster to retrieve sensitive information from the state storage bucket and escalate to cluster-admin permissions.


This issue has been rated High (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and assigned CVE-2023-1943.

Affected Components and Configurations

This bug affects the kOps GCP provider, only when running in Gossip Mode. See below for information about other providers.

Affected Versions

  • v1.26.0 - v1.26.1

  • <v1.25.4

Fixed Versions

  • v1.26.2

  • V1.25.4


Recent kOps improvements have systematically reduced the potential for this class of attacks, by reducing or eliminating cloud credentials/privileges on the nodes.  The recommended versions vary by cloud:


AWS users: should not be affected in recent versions.  kOps version 1.26 (or later) is recommended, but not a critical update.

GCE users: recommended kOps version is 1.26.3 (or later).

DigitalOcean users: recommended kOps version is 1.27.0-alpha.2 (or later), with `--dns=none` for new clusters.  Cloud credentials have been removed from the nodes in this configuration.  Future versions will likely make dns=none the default.

Hetzner users: recommended kOps version is 1.27.0-alpha.2 (or later).  Cloud credentials have been removed from the nodes in this configuration.


(Azure, Scaleway and other cloud providers are following the same approach, but as these are in alpha we recommend using the latest kOps version, and generally do not recommend production usage when in alpha).

Detection

If you find evidence that this vulnerability has been exploited, please contact secu...@kubernetes.io

Additional Details

See kOps Issue #15539 for more details.

Acknowledgements

This vulnerability was reported by James Cleverley-Prance


Thank You,

CJ Cullen on behalf of the Kubernetes Security Response Committee


Reply all
Reply to author
Forward
0 new messages