Kubernetes kubelet/kube-proxy up to 1.16.10/1.17.6/1.18.3 Localhost Boundary unprotected alternate channel

Summaryinfo

A vulnerability described as critical has been identified in Kubernetes kubelet and kube-proxy up to 1.16.10/1.17.6/1.18.3. This vulnerability affects unknown code of the component Localhost Boundary Handler. Such manipulation leads to unprotected alternate channel. This vulnerability is traded as CVE-2020-8558. Access to the local network is required for this attack to succeed. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Kubernetes kubelet and kube-proxy up to 1.16.10/1.17.6/1.18.3 (Virtualization Software). Affected by this issue is an unknown code block of the component Localhost Boundary Handler. The manipulation with an unknown input leads to a unprotected alternate channel vulnerability. Using CWE to declare the problem leads to CWE-420. The product protects a primary channel, but it does not use the same level of protection for an alternate channel. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

The weakness was shared 07/09/2020 (Website). The advisory is shared for download at blog.alcide.io. This vulnerability is handled as CVE-2020-8558. Access to the local network is required for this attack. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The advisory points out:

A security issue was discovered in kube-proxy which allows adjacent nodes/hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace (host network). This breaks security assumptions made by services listening on localhost.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

aws.amazon.com is providing further details. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Vendor

• Kubernetes

Name

• kube-proxy
• kubelet

Version

• 1.16.0
• 1.16.1
• 1.16.2
• 1.16.3
• 1.16.4
• 1.16.5
• 1.16.6
• 1.16.7
• 1.16.8
• 1.16.9
• 1.16.10
• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.17.4
• 1.17.5
• 1.17.6
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion