GO-2023-2330
Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes
At a glance
- Published
- Updated
- CVE
- CVE-2023-3676
- Aliases
- GHSA-7fxm-f474-hf8w
Description
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
Affected packages
| Package | Versions |
|---|---|
| Go · k8s.io/kubernetes | introduced 0, fixed 1.24.17, introduced 1.25.0, fixed 1.25.13, introduced 1.26.0, fixed 1.26.8, introduced 1.27.0, fixed 1.27.5, introduced 1.28.0, fixed 1.28.1 |
References
- https://github.com/advisories/GHSA-7fxm-f474-hf8w ADVISORY
- https://github.com/kubernetes/kubernetes/commit/073f9ea33a93ddaecdc2e829150fb715f6387399 WEB
- https://github.com/kubernetes/kubernetes/commit/39cc101c7855341c651a943b9836b50fbace8a6b WEB
- https://github.com/kubernetes/kubernetes/commit/74b617310c24ca84c2ec90c3858af745d65b5226 WEB
- https://github.com/kubernetes/kubernetes/commit/890483394221c8f22e88c48f86cd4eaf4de65fd6 WEB
- https://github.com/kubernetes/kubernetes/commit/a53faf5e17ed0b0771a605c6401ba4cbf297b59a WEB
- https://github.com/kubernetes/kubernetes/issues/119339 WEB
- https://github.com/kubernetes/kubernetes/pull/120127 WEB
- https://github.com/kubernetes/kubernetes/pull/120129 WEB
- https://github.com/kubernetes/kubernetes/pull/120130 WEB
- https://github.com/kubernetes/kubernetes/pull/120131 WEB
- https://github.com/kubernetes/kubernetes/pull/120132 WEB
- https://github.com/kubernetes/kubernetes/pull/120133 WEB
- https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc WEB
- https://security.netapp.com/advisory/ntap-20231130-0007 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |