GHSA-82m2-cv7p-4m75

Kubernetes sets incorrect permissions on Windows containers logs

At a glance

Published: 2024-07-18 21:30 UTC
Updated: 2026-09-10 03:50 UTC
CVE: CVE-2024-5321
Aliases: GO-2024-2994
CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Description

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

Affected packages

Package	Versions
Go · k8s.io/kubernetes	introduced 0, fixed 1.27.16
Go · k8s.io/kubernetes	introduced 1.28.0, fixed 1.28.12
Go · k8s.io/kubernetes	introduced 1.29.0, fixed 1.29.7
Go · k8s.io/kubernetes	introduced 1.30.0, fixed 1.30.3

References

https://nvd.nist.gov/vuln/detail/CVE-2024-5321 ADVISORY
https://github.com/kubernetes/kubernetes/issues/126161 WEB
https://github.com/kubernetes/kubernetes/commit/23660a78ae462a6c8c75ac7ffd9af97550dda1aa WEB
https://github.com/kubernetes/kubernetes/commit/84beb2915fa28ae477fe0676be8ba94ccd2b811a WEB
https://github.com/kubernetes/kubernetes/commit/90589b8f63d28bcd3db89749950ebc48ed07c190 WEB
https://github.com/kubernetes/kubernetes/commit/de2033033b1d202ecaaa79d41861a075df8b49c1 WEB
https://github.com/kubernetes/kubernetes PACKAGE
https://groups.google.com/g/kubernetes-security-announce/c/81c0BHkKNt0 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database