oss-security - [kubernetes] CVE-2025-1767: GitRepo Volume Inadvertent Local Repository Access

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <3CF0EED5-09AE-4973-ACAA-CD19215780C3@amazon.com>
Date: Thu, 13 Mar 2025 16:14:24 +0000
From: "Vellore Rajakumar, Sri Saran Balaji" <srajakum@...zon.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: [kubernetes] CVE-2025-1767: GitRepo Volume Inadvertent Local
 Repository Access

Issue Details

A security vulnerability was discovered in Kubernetes that could allow a user with create pod permission to exploit gitRepo volumes to access local git repositories belonging to other pods on the same node.

This issue has been rated Medium (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N>) (score: 6.5), and assigned CVE-2025-1767.

Am I vulnerable?

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.

Affected Components

  *   kubelet

Affected Versions

  *   All versions of Kubernetes

How do I mitigate this vulnerability?

To mitigate this vulnerability, you must use an init container to perform git clone operation and then mount the directory into the Pod's container. An example of this approach is provided here<https://gist.github.com/tallclair/849601a16cebeee581ef2be50c351841>.

Note: You can also restrict the use of gitRepo volumes in your cluster using policies such as ValidatingAdmissionPolicy or through Restricted pod security standard policy. You can use the following Common Expression Language (CEL) expression as part of a policy to reject use of gitRepo volumes: `has(object.spec.volumes) || !object.spec.volumes.exists(v, has(v.gitRepo))`

Detection
To detect whether this vulnerability has been exploited, you can use the following command to list all pods that use the in-tree gitRepo volume and clones to a .git subdirectory.

`kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.volumes[].gitRepo.repository | test("^/")) | {name: .metadata.name, namespace: .metadata.namespace, repository: (.spec.volumes[] | select(.gitRepo) | .gitRepo.repository)}'`

If you find evidence that this vulnerability has been exploited, please contact security@...ernetes.io<mailto:security@...ernetes.io>

Additional Details
See Kubernetes Issue #130786<https://github.com/kubernetes/kubernetes/pull/130786> for more details.

Acknowledgements
This vulnerability was reported by Christophe Hauquiert.

Thank You,

Balaji on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.