oss-security - [kubernetes] CVE-2024-5321: Incorrect permissions on Windows containers logs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAHXwHVxp93_7XdjkCGQ6DsV_5RbprkZhfDMmxgUvbMWo49mvFA@mail.gmail.com>
Date: Wed, 17 Jul 2024 09:09:43 -0400
From: Craig Ingram <cjingram@...gle.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] CVE-2024-5321: Incorrect permissions on Windows
 containers logs

Hello Kubernetes Community,

A security issue was discovered in Kubernetes clusters with Windows nodes
where BUILTIN\Users may be able to read container logs and NT
AUTHORITY\Authenticated Users may be able to modify container logs.

This issue has been rated Medium (
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N>),
and assigned CVE-2024-5321.

Am I vulnerable?

Any Kubernetes environment with Windows nodes is affected. Run kubectl get
nodes -l kubernetes.io/os=windows to see if any Windows nodes are in use.

Affected Versions

- kubelet <= 1.27.15

- kubelet <= 1.28.11

- kubelet <= 1.29.6

- kubelet <= 1.30.2

How do I mitigate this vulnerability?

This issue can be mitigated by applying the patch provided. The patch
includes changes to pkg/util/filesystem that set file permissions on
Windows and hardens the permissions for container logs for containers
running on Windows.

Fixed Versions

- kubelet 1.27.16

- kubelet 1.28.12

- kubelet 1.29.7

- kubelet 1.30.3

To upgrade, refer to the documentation:
https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/

Detection

Any Kubernetes environment with Windows nodes is affected. Run kubectl get
nodes -l kubernetes.io/os=windows to see if any Windows nodes are in use.

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io

Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/126161

Acknowledgements

This vulnerability was reported by Paulo Gomes <https://github.com/pjbgf>
from SUSE.

The issue was fixed and coordinated by the fix team:

Mark Rossetti @marosset

James Sturtevant @jsturtevant

Craig Ingram @cji

Rita Zhang @ritazh

and release managers:

Sascha Grunert @saschagrunert

Jeremy Rickard @jeremyrickard

Carlos Panato @cpanato

Jim Angel @jimangel

Thank You,

Craig Ingram on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.