From 2432d6d1fdfdf37c2d9bedf30a7bd31263c99058 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marko=20Mudrini=C4=87?= Date: Thu, 10 Nov 2022 19:39:53 +0100 Subject: [PATCH 1/5] Add CVE-2022-3162 to CHANGELOG-1.25.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marko Mudrinić --- CHANGELOG/CHANGELOG-1.25.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/CHANGELOG/CHANGELOG-1.25.md b/CHANGELOG/CHANGELOG-1.25.md index e239bf45514..64973691800 100644 --- a/CHANGELOG/CHANGELOG-1.25.md +++ b/CHANGELOG/CHANGELOG-1.25.md @@ -9,6 +9,7 @@ - [Container Images](#container-images) - [Changelog since v1.25.3](#changelog-since-v1253) - [Important Security Information](#important-security-information) + - [CVE-2022-3162: Unauthorized read of Custom Resources](#cve-2022-3162-unauthorized-read-of-custom-resources) - [CVE-2022-3294: Node address isn't always verified when proxying](#cve-2022-3294-node-address-isnt-always-verified-when-proxying) - [Changes by Kind](#changes-by-kind) - [API Change](#api-change) @@ -288,6 +289,28 @@ name | architectures This release contains changes that address the following vulnerabilities: +### CVE-2022-3162: Unauthorized read of Custom Resources + +A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read. + +**Affected Versions**: + - kube-apiserver v1.25.0 - v1.25.3 + - kube-apiserver v1.24.0 - v1.24.7 + - kube-apiserver v1.23.0 - v1.23.13 + - kube-apiserver v1.22.0 - v1.22.15 + - kube-apiserver <= v1.21.? + +**Fixed Versions**: + - kube-apiserver v1.25.4 + - kube-apiserver v1.24.8 + - kube-apiserver v1.23.13 + - kube-apiserver v1.22.16 + +This vulnerability was reported by Richard Turnbull of NCC Group as part of the Kubernetes Audit + + +**CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) + ### CVE-2022-3294: Node address isn't always verified when proxying A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them. From 04ad0d4b67e368e88d4db2735c7a649341301461 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marko=20Mudrini=C4=87?= Date: Thu, 10 Nov 2022 19:40:38 +0100 Subject: [PATCH 2/5] Add CVE-2022-3162 to CHANGELOG-1.24.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marko Mudrinić --- CHANGELOG/CHANGELOG-1.24.md | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/CHANGELOG/CHANGELOG-1.24.md b/CHANGELOG/CHANGELOG-1.24.md index feb0a0518ba..84ef532a75f 100644 --- a/CHANGELOG/CHANGELOG-1.24.md +++ b/CHANGELOG/CHANGELOG-1.24.md @@ -9,6 +9,7 @@ - [Container Images](#container-images) - [Changelog since v1.24.7](#changelog-since-v1247) - [Important Security Information](#important-security-information) + - [CVE-2022-3162: Unauthorized read of Custom Resources](#cve-2022-3162-unauthorized-read-of-custom-resources) - [CVE-2022-3294: Node address isn't always verified when proxying](#cve-2022-3294-node-address-isnt-always-verified-when-proxying) - [Changes by Kind](#changes-by-kind) - [API Change](#api-change) @@ -57,7 +58,7 @@ - [Changelog since v1.24.4](#changelog-since-v1244) - [Important Security Information](#important-security-information-1) - [CVE-2022-3172: Aggregated API server can cause clients to be redirected (SSRF)](#cve-2022-3172-aggregated-api-server-can-cause-clients-to-be-redirected-ssrf) - - [CVE-2021-25749: runAsNonRoot logic bypass for Windows containers](#cve-2021-25749-runasnonroot-logic-bypass-for-windows-containers) + - [CVE-2021-25749: `runAsNonRoot` logic bypass for Windows containers](#cve-2021-25749-runasnonroot-logic-bypass-for-windows-containers) - [Am I vulnerable?](#am-i-vulnerable) - [Affected Versions](#affected-versions) - [How do I mitigate this vulnerability?](#how-do-i-mitigate-this-vulnerability) @@ -364,6 +365,28 @@ name | architectures This release contains changes that address the following vulnerabilities: +### CVE-2022-3162: Unauthorized read of Custom Resources + +A security issue was discovered in Kubernetes where users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group they are not authorized to read. + +**Affected Versions**: + - kube-apiserver v1.25.0 - v1.25.3 + - kube-apiserver v1.24.0 - v1.24.7 + - kube-apiserver v1.23.0 - v1.23.13 + - kube-apiserver v1.22.0 - v1.22.15 + - kube-apiserver <= v1.21.? + +**Fixed Versions**: + - kube-apiserver v1.25.4 + - kube-apiserver v1.24.8 + - kube-apiserver v1.23.13 + - kube-apiserver v1.22.16 + +This vulnerability was reported by Richard Turnbull of NCC Group as part of the Kubernetes Audit + + +**CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) + ### CVE-2022-3294: Node address isn't always verified when proxying A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them. From dcee13c924d5506a3ccf8895fccfcb471bb956e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marko=20Mudrini=C4=87?= Date: Thu, 10 Nov 2022 19:41:16 +0100 Subject: [PATCH 3/5] Add CVE-2022-3294 to CHANGELOG-1.23.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marko Mudrinić --- CHANGELOG/CHANGELOG-1.23.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/CHANGELOG/CHANGELOG-1.23.md b/CHANGELOG/CHANGELOG-1.23.md index 194727a85ce..84c864796e0 100644 --- a/CHANGELOG/CHANGELOG-1.23.md +++ b/CHANGELOG/CHANGELOG-1.23.md @@ -10,6 +10,7 @@ - [Changelog since v1.23.13](#changelog-since-v12313) - [Important Security Information](#important-security-information) - [CVE-2022-3162: Unauthorized read of Custom Resources](#cve-2022-3162-unauthorized-read-of-custom-resources) + - [CVE-2022-3294: Node address isn't always verified when proxying](#cve-2022-3294-node-address-isnt-always-verified-when-proxying) - [Changes by Kind](#changes-by-kind) - [API Change](#api-change) - [Bug or Regression](#bug-or-regression) @@ -468,6 +469,32 @@ This vulnerability was reported by Richard Turnbull of NCC Group as part of the **CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) +### CVE-2022-3294: Node address isn't always verified when proxying + +A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them. + +Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to be redirected to the API Server through its private network. + +The merged fix enforces validation against the proxying address for a Node. In some cases, the fix can break clients that depend on the `nodes/proxy` subresource, specifically if a kubelet advertises a localhost or link-local address to the Kubernetes control plane. Configuring an egress proxy for egress to the cluster network can also mitigate this vulnerability. + +**Affected Versions**: + - kube-apiserver v1.25.0 - v1.25.3 + - kube-apiserver v1.24.0 - v1.24.7 + - kube-apiserver v1.23.0 - v1.23.13 + - kube-apiserver v1.22.0 - v1.22.15 + - kube-apiserver <= v1.21.? + +**Fixed Versions**: + - kube-apiserver v1.25.4 + - kube-apiserver v1.24.8 + - kube-apiserver v1.23.13 + - kube-apiserver v1.22.16 + +This vulnerability was reported by Yuval Avrahami of Palo Alto Networks + + +**CVSS Rating:** Medium (6.6) [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) + ## Changes by Kind ### API Change From d34373cdbe90a766ae1ce4ea272cddd6ecddd2c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marko=20Mudrini=C4=87?= Date: Thu, 10 Nov 2022 19:41:59 +0100 Subject: [PATCH 4/5] Add CVE-2022-3294 to CHANGELOG-1.22.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marko Mudrinić --- CHANGELOG/CHANGELOG-1.22.md | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/CHANGELOG/CHANGELOG-1.22.md b/CHANGELOG/CHANGELOG-1.22.md index 03f64ff1199..52a303d7f38 100644 --- a/CHANGELOG/CHANGELOG-1.22.md +++ b/CHANGELOG/CHANGELOG-1.22.md @@ -10,6 +10,7 @@ - [Changelog since v1.22.15](#changelog-since-v12215) - [Important Security Information](#important-security-information) - [CVE-2022-3162: Unauthorized read of Custom Resources](#cve-2022-3162-unauthorized-read-of-custom-resources) + - [CVE-2022-3294: Node address isn't always verified when proxying](#cve-2022-3294-node-address-isnt-always-verified-when-proxying) - [Dependencies](#dependencies) - [Added](#added) - [Changed](#changed) @@ -38,7 +39,7 @@ - [Changelog since v1.22.13](#changelog-since-v12213) - [Important Security Information](#important-security-information-1) - [CVE-2022-3172: Aggregated API server can cause clients to be redirected (SSRF)](#cve-2022-3172-aggregated-api-server-can-cause-clients-to-be-redirected-ssrf) - - [CVE-2021-25749: runAsNonRoot logic bypass for Windows containers](#cve-2021-25749-runasnonroot-logic-bypass-for-windows-containers) + - [CVE-2021-25749: `runAsNonRoot` logic bypass for Windows containers](#cve-2021-25749-runasnonroot-logic-bypass-for-windows-containers) - [Am I vulnerable?](#am-i-vulnerable) - [Affected Versions](#affected-versions) - [How do I mitigate this vulnerability?](#how-do-i-mitigate-this-vulnerability) @@ -265,7 +266,7 @@ - [API changes and improvements for ephemeral containers](#api-changes-and-improvements-for-ephemeral-containers) - [Known Issues](#known-issues) - [CPU and Memory manager are not working correctly for Guaranteed Pods with multiple containers](#cpu-and-memory-manager-are-not-working-correctly-for-guaranteed-pods-with-multiple-containers) - - [CSIMigrationvSphere feature gate has not migrated to new CRD APIs](#csimigrationvsphere-feature-gate-has-not-migrated-to-new-crd-apis) + - [`CSIMigrationvSphere` feature gate has not migrated to new CRD APIs](#csimigrationvsphere-feature-gate-has-not-migrated-to-new-crd-apis) - [Workloads that saturate nodes with pods may see pods that fail due to node admission](#workloads-that-saturate-nodes-with-pods-may-see-pods-that-fail-due-to-node-admission) - [Etcd v3.5.[0-2] data corruption](#etcd-v350-2-data-corruption) - [Urgent Upgrade Notes](#urgent-upgrade-notes) @@ -323,6 +324,7 @@ - [Changes by Kind](#changes-by-kind-18) - [Deprecation](#deprecation-1) - [API Change](#api-change-5) + - [Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:](#additional-documentation-eg-keps-kubernetes-enhancement-proposals-usage-docs-etc) - [Feature](#feature-10) - [Documentation](#documentation-1) - [Bug or Regression](#bug-or-regression-18) @@ -504,6 +506,32 @@ This vulnerability was reported by Richard Turnbull of NCC Group as part of the **CVSS Rating:** Medium (6.5) [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) +### CVE-2022-3294: Node address isn't always verified when proxying + +A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can to modify Node objects and send requests proxying through them. + +Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to be redirected to the API Server through its private network. + +The merged fix enforces validation against the proxying address for a Node. In some cases, the fix can break clients that depend on the `nodes/proxy` subresource, specifically if a kubelet advertises a localhost or link-local address to the Kubernetes control plane. Configuring an egress proxy for egress to the cluster network can also mitigate this vulnerability. + +**Affected Versions**: + - kube-apiserver v1.25.0 - v1.25.3 + - kube-apiserver v1.24.0 - v1.24.7 + - kube-apiserver v1.23.0 - v1.23.13 + - kube-apiserver v1.22.0 - v1.22.15 + - kube-apiserver <= v1.21.? + +**Fixed Versions**: + - kube-apiserver v1.25.4 + - kube-apiserver v1.24.8 + - kube-apiserver v1.23.13 + - kube-apiserver v1.22.16 + +This vulnerability was reported by Yuval Avrahami of Palo Alto Networks + + +**CVSS Rating:** Medium (6.6) [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) + ## Dependencies ### Added From ecfc7f189d3fe16c43c9f04af520a7566b81107f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marko=20Mudrini=C4=87?= Date: Thu, 10 Nov 2022 19:43:53 +0100 Subject: [PATCH 5/5] Add CVE-2021-25749 to CHANGELOG-1.23.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Marko Mudrinić --- CHANGELOG/CHANGELOG-1.23.md | 49 +++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/CHANGELOG/CHANGELOG-1.23.md b/CHANGELOG/CHANGELOG-1.23.md index 84c864796e0..632fbb3f058 100644 --- a/CHANGELOG/CHANGELOG-1.23.md +++ b/CHANGELOG/CHANGELOG-1.23.md @@ -56,6 +56,7 @@ - [Changelog since v1.23.10](#changelog-since-v12310) - [Important Security Information](#important-security-information-1) - [CVE-2022-3172: Aggregated API server can cause clients to be redirected (SSRF)](#cve-2022-3172-aggregated-api-server-can-cause-clients-to-be-redirected-ssrf) + - [CVE-2021-25749: `runAsNonRoot` logic bypass for Windows containers](#cve-2021-25749-runasnonroot-logic-bypass-for-windows-containers) - [Changes by Kind](#changes-by-kind-3) - [Bug or Regression](#bug-or-regression-3) - [Dependencies](#dependencies-3) @@ -803,6 +804,54 @@ This vulnerability was reported by Nicolas Joly & Weinong Wang from Microsoft **CVSS Rating:** Medium (5.1) [CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L) +### CVE-2021-25749: `runAsNonRoot` logic bypass for Windows containers + +A security issue was discovered in Kubernetes that could allow Windows workloads to run as `ContainerAdministrator` even when those workloads set the `runAsNonRoot` option to `true `. + +This issue has been rated low and assigned CVE-2021-25749 + +**Am I vulnerable?** + +All Kubernetes clusters with following versions, running Windows workloads with `runAsNonRoot` are impacted + +**Affected Versions**: + +- kubelet v1.20 - v1.21 +- kubelet v1.22.0 - v1.22.13 +- kubelet v1.23.0 - v1.23.10 +- kubelet v1.24.0 - v1.24.4 + +**How do I mitigate this vulnerability?** + +There are no known mitigations to this vulnerability. + +**Fixed Versions**: + +- kubelet v1.22.14 +- kubelet v1.23.11 +- kubelet v1.24.5 +- kubelet v1.25.0 + + +To upgrade, refer to this documentation _For core Kubernetes:_ https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster + +**Detection**: + +Kubernetes Audit logs may indicate if the user name was misspelled to bypass the restriction placed on which user is a pod allowed to run as. + +If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io + +**Additional Details**: + +See the GitHub issue for more details: https://github.com/kubernetes/kubernetes/issues/112192 + +**Acknowledgements**: + +This vulnerability was reported and fixed by Mark Rosetti (@marosset) + + +**CVSS Rating:** Low (3.4) [CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C) + ## Changes by Kind ### Bug or Regression