KubeEdge up to 1.9.3/1.10.1/1.11.0 Cloud Stream Server/Edge Stream Server resource consumption

Summaryinfo

A vulnerability categorized as problematic has been discovered in KubeEdge up to 1.9.3/1.10.1/1.11.0. Affected is an unknown function of the component Cloud Stream Server/Edge Stream Server. Executing a manipulation can lead to resource consumption. The identification of this vulnerability is CVE-2022-31079. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in KubeEdge up to 1.9.3/1.10.1/1.11.0. This vulnerability affects an unknown functionality of the component Cloud Stream Server/Edge Stream Server. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size of this message. An attacker can exploit this by sending a large message to exhaust memory and cause a DoS. The Cloud Stream server and the Edge Stream server are under DoS attack in this case. The consequence of the exhaustion is that the CloudCore and EdgeCore will be in a denial of service. Only an authenticated user can cause this issue. It will be affected only when users enable `cloudStream` module in the config file `cloudcore.yaml` and enable `edgeStream` module in the config file `edgecore.yaml`. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable cloudStream module in the config file `cloudcore.yaml` and disable edgeStream module in the config file `edgecore.yaml`.

The weakness was shared 07/12/2022 as GHSA-wrcr-x4qj-j543. The advisory is available at github.com. This vulnerability was named CVE-2022-31079 since 05/18/2022. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 1.9.4, 1.10.2 or 1.11.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• KubeEdge

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.10
• 1.10.0
• 1.10.1
• 1.11.0

Website

• Product: https://github.com/kubeedge/kubeedge/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion