Kubernetes up to 1.9.5 kubectl cp data processing

Summaryinfo

A vulnerability identified as critical has been detected in Kubernetes up to 1.5.x/1.6.x/1.7.x/1.8.x/1.9.5. Affected by this vulnerability is an unknown functionality of the component kubectl. The manipulation of the argument cp as part of Command leads to data processing. This vulnerability is uniquely identified as CVE-2018-1002100. Local access is required to approach this attack. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Kubernetes up to 1.5.x/1.6.x/1.7.x/1.8.x/1.9.5 (Virtualization Software). It has been rated as critical. This issue affects some unknown functionality of the component kubectl. The manipulation of the argument cp as part of a Command leads to a data processing vulnerability. Using CWE to declare the problem leads to CWE-19. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.

The bug was discovered 05/17/2018. The weakness was disclosed 06/02/2018 as Bug 1564305 as not defined bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2018-1002100 since 06/01/2018. The exploitation is known to be easy. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 15 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371083 (Kubernetes arbitrary path traversal vulnerability).

Upgrading to version 1.9.6 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-2004). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Kubernetes

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion