knative serving up to 0.38.x Autoscaler /metrics resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in knative serving up to 0.38.x. This issue affects some unknown processing of the file /metrics of the component Autoscaler. The manipulation results in resource consumption. This vulnerability was named CVE-2023-48713. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in knative serving up to 0.38.x. It has been classified as problematic. Affected is an unknown part of the file /metrics of the component Autoscaler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound memory allocation bug. This is a DoS vulnerability, where a non-privileged Knative user can cause a DoS for the cluster. This issue has been patched in version 0.39.0.

The weakness was presented 11/28/2023 as GHSA-qmvj-4qr9-v547. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-48713 since 11/17/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 0.39.0 eliminates this vulnerability. Applying the patch 012ee2509231b80b7842139bfabc30516d3026ca is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• knative

Name

• serving

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38

License

• open-source

Website

• Product: https://github.com/knative/serving/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion