Kubernetes kublet up to 1.16.12/1.17.8/1.18.5 /etc/hosts resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in Kubernetes kublet up to 1.16.12/1.17.8/1.18.5. This affects an unknown part of the file /etc/hosts. The manipulation results in resource consumption. This vulnerability is reported as CVE-2020-8557. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Kubernetes kublet up to 1.16.12/1.17.8/1.18.5 (Virtualization Software). Affected is an unknown part of the file /etc/hosts. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.

The weakness was disclosed 07/23/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is traded as CVE-2020-8557 since 02/03/2020. The attack needs to be approached locally. A authentication is necessary for exploitation. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Vendor

• Kubernetes

Name

• kublet

Version

• 1.16.0
• 1.16.1
• 1.16.2
• 1.16.3
• 1.16.4
• 1.16.5
• 1.16.6
• 1.16.7
• 1.16.8
• 1.16.9
• 1.16.10
• 1.16.11
• 1.16.12
• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.17.4
• 1.17.5
• 1.17.6
• 1.17.7
• 1.17.8
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3
• 1.18.4
• 1.18.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion