Kubernetes kube-apiserver 1.3.0 race condition

Summaryinfo

A vulnerability classified as problematic has been found in Kubernetes kube-apiserver 1.3.0. This vulnerability affects unknown code. This manipulation causes race condition. This vulnerability appears as CVE-2024-7598. The attacker needs to be present on the local network. There is no available exploit.

Detailsinfo

A vulnerability has been found in Kubernetes kube-apiserver 1.3.0 and classified as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality. The summary by CVE is:

A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.

The weakness was presented by John Mcguinness as 126587. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-7598 since 08/07/2024. The exploitation appears to be difficult. Access to the local network is required for this attack to succeed. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Kubernetes

Name

• kube-apiserver

Version

• 1.3.0

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion