GO-2023-2170
Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes and k8s.io/mount-utils
At a glance
- Published
- Updated
- CVE
- CVE-2023-3955
- Aliases
- GHSA-q78c-gwqw-jcmc
Description
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
Affected packages
| Package | Versions |
|---|---|
| Go · k8s.io/kubernetes | introduced 0, fixed 1.24.17, introduced 1.25.0, fixed 1.25.13, introduced 1.26.0, fixed 1.26.8, introduced 1.27.0, fixed 1.27.5, introduced 1.28.0, fixed 1.28.1 |
| Go · k8s.io/mount-utils | introduced 0, fixed 0.24.17, introduced 0.25.0, fixed 0.25.13, introduced 0.26.0, fixed 0.26.8, introduced 0.27.0, fixed 0.27.5, introduced 0.28.0, fixed 0.28.1 |
References
- https://github.com/advisories/GHSA-q78c-gwqw-jcmc ADVISORY
- https://github.com/kubernetes/kubernetes/commit/38c97fa67ed35f36e730856728c9e3807f63546a WEB
- https://github.com/kubernetes/kubernetes/commit/50334505cd27cbe7cf71865388f25a00e29b2596 WEB
- https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9 WEB
- https://github.com/kubernetes/kubernetes/commit/b7547e28f898af37aa2f1107a49111f963250fe6 WEB
- https://github.com/kubernetes/kubernetes/commit/c4e17abb04728e3a3f9bb26e727b0f978df20ec9 WEB
- https://github.com/kubernetes/kubernetes/issues/119595 WEB
- https://github.com/kubernetes/kubernetes/pull/120128 WEB
- https://github.com/kubernetes/kubernetes/pull/120134 WEB
- https://github.com/kubernetes/kubernetes/pull/120135 WEB
- https://github.com/kubernetes/kubernetes/pull/120136 WEB
- https://github.com/kubernetes/kubernetes/pull/120137 WEB
- https://github.com/kubernetes/kubernetes/pull/120138 WEB
- https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |