oss-security - [kubernetes/kops] CVE-2023-1943: Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CABdrxGCTFixuOZWpSVzgbVnj4Em=GpMgapSarnLHAV9+3CG0bw@mail.gmail.com>
Date: Wed, 21 Jun 2023 11:19:42 -0700
From: CJ Cullen <cjcullen@...gle.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes/kops] CVE-2023-1943: Privilege Escalation in kOps using
 GCE/GCP Provider in Gossip Mode

Issue Details

A security issue was reported in kOps <https://github.com/kubernetes/kops>
with the GCP Provider running in Gossip Mode
<https://kops.sigs.k8s.io/gossip/>, where Node service account credentials
could be used by a container running in the cluster to retrieve sensitive
information from the state storage bucket and escalate to cluster-admin
permissions.

This issue has been rated High (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H>),
and assigned CVE-2023-1943.
Affected Components and Configurations

This bug affects the kOps GCP provider, only when running in Gossip Mode.
See below for information about other providers.
Affected Versions

   -

   v1.26.0 - v1.26.1
   -

   <v1.25.4

Fixed Versions

   -

   v1.26.2
   -

   V1.25.4

Recent kOps improvements have systematically reduced the potential for this
class of attacks, by reducing or eliminating cloud credentials/privileges
on the nodes.  The recommended versions vary by cloud:

AWS users: should not be affected in recent versions.  kOps version 1.26
(or later) is recommended, but not a critical update.

GCE users: recommended kOps version is 1.26.3 (or later).

DigitalOcean users: recommended kOps version is 1.27.0-alpha.2 (or later),
with `--dns=none` for new clusters.  Cloud credentials have been removed
from the nodes in this configuration.  Future versions will likely make
dns=none the default.

Hetzner users: recommended kOps version is 1.27.0-alpha.2 (or later).
Cloud credentials have been removed from the nodes in this configuration.

(Azure, Scaleway and other cloud providers are following the same approach,
but as these are in alpha we recommend using the latest kOps version, and
generally do not recommend production usage when in alpha).
Detection

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io
Additional Details

See kOps Issue #15539 <https://github.com/kubernetes/kops/issues/15539> for
more details.
Acknowledgements

This vulnerability was reported by James Cleverley-Prance

Thank You,

CJ Cullen on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.