If you run a Kubernetes cluster, you probably heard the news this week about CVE-2018-1002105. This is a privilege escalation issue within Kubernetes that essentially allowed one to send commands to a Kubernetes cluster and administer the cluster without appropriate permissions.
About Kubernetes CVE-2018-1002105
We are going to explain the vulnerability in very simplistic terms since many of our readers are still new to Kubernetes. At its essence, Kubernetes has an API server that allows one to send queries and requests to the backend servers. With CVE-2018-1002105, one could craft requests to the Kubernetes API server that would allow one to send commands from the API server to the backend servers, validated by the API server credentials. Using this method, and depending upon your API server configuration, one was able to send commands to turn off or start services on the back end server as if it was the API server requesting the action from an authenticated and valid API request. Essentially, this is like a root level vulnerability for an entire Kubernetes cluster.
The concern with the vulnerability is that they show as properly authorized actions in logs. On most clusters, it will be nearly impossible to distinguish a legitimate API call versus one exploiting the CVE-2018-1002105 vulnerability. Looking like a normal entry in a log will not trigger alarms in monitoring software, and can make forensic investigation difficult to see if this privilege escalation vulnerability was used.
Resources for More on CVE-2018-1002105
Here are a few resources for those who are running Kubernetes and want to know more. Major vendors have already patched this vulnerability but if you are not updating components regularly, they will be worth a read.
- Red Hat 1: Understanding the critical Kubernetes privilege escalation flaw in OpenShift 3
- Red Hat 2: Kubernetes privilege escalation and access to sensitive information in OpenShift products and services – CVE-2018-1002105
- Kubernetes GitHub: CVE-2018-1002105: proxy request handling in kube-apiserver can leave vulnerable TCP connections
- Kubernetes Disclosure: See here
- Ubuntu 1: CVE-2018-1002105
- Ubuntu 2: Canonical publishes auto-apply vulnerability patch for Kubernetes
There is a lot more out there on the vulnerability. It is a big one that was responsibly disclosed by a Rancher Labs executive and the community has done a great job mitigating.
