oss-security - [kubernetes] CVE-2024-10220: Arbitrary command execution through gitRepo volume

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAHXwHVx722YeWTTpfB6cTgHifbYBsEsdfYAeMJ=uDhzcgJw+2w@mail.gmail.com>
Date: Wed, 20 Nov 2024 10:31:53 -0500
From: Craig Ingram <cjingram@...gle.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] CVE-2024-10220: Arbitrary command execution through
 gitRepo volume

Hello Kubernetes Community,

A security vulnerability was discovered in Kubernetes that could allow a
user with the ability to create a pod and associate a gitRepo volume to
execute arbitrary commands beyond the container boundary. This
vulnerability leverages the hooks folder in the target repository to run
arbitrary commands outside of the container's boundary.

Please note that this issue was originally publicly disclosed with a fix in
July (#124531 <https://github.com/kubernetes/kubernetes/pull/124531>), and
we are retroactively assigning it a CVE to assist in awareness and tracking.

This issue has been rated High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N>)
(score: 8.1), and assigned CVE-2024-10220.
Am I vulnerable?

This CVE affects Kubernetes clusters where pods use the in-tree gitRepo
volume to clone a repository to a subdirectory. If the Kubernetes cluster
is running one of the affected versions listed below, then it is vulnerable
to this issue.
Affected Versions

   -

   kubelet v1.30.0 to v1.30.2
   -

   kubelet v1.29.0 to v1.29.6
   -

   kubelet <= v1.28.11

How do I mitigate this vulnerability?To mitigate this vulnerability, you
must upgrade your Kubernetes cluster to one of the fixed versions listed
below. Additionally, since the gitRepo volume has been deprecated, the
recommended solution is to perform the Git clone operation using an init
container and then mount the directory into the Pod's container. An example
of this approach is provided here
<https://gist.github.com/tallclair/849601a16cebeee581ef2be50c351841>.Fixed
Versions

   -

   kubelet v1.31.0
   -

   kubelet v1.30.3
   -

   kubelet v1.29.7
   -

   kubelet v1.28.12

Detection

To detect whether this vulnerability has been exploited, you can use the
following command to list all pods that use the in-tree gitRepo volume and
clones to a .git subdirectory.

kubectl get pods --all-namespaces -o json | jq '.items[] |
select(.spec.volumes[].gitRepo.directory | endswith("/.git")) | {name: .
metadata.name, namespace: .metadata.namespace}

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io
Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/128885
Acknowledgements

This vulnerability was reported and mitigated by Imre Rad.

Thank You,

Craig Ingram on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.