Kubernetes and the Challenge of a Huge Security Vulnerability CVE-2018-1002105

Kubernetes Logo
Kubernetes Logo

If you run a Kubernetes cluster, you probably heard the news this week about CVE-2018-1002105. This is a privilege escalation issue within Kubernetes that essentially allowed one to send commands to a Kubernetes cluster and administer the cluster without appropriate permissions.

About Kubernetes CVE-2018-1002105

We are going to explain the vulnerability in very simplistic terms since many of our readers are still new to Kubernetes. At its essence, Kubernetes has an API server that allows one to send queries and requests to the backend servers. With CVE-2018-1002105, one could craft requests to the Kubernetes API server that would allow one to send commands from the API server to the backend servers, validated by the API server credentials. Using this method, and depending upon your API server configuration, one was able to send commands to turn off or start services on the back end server as if it was the API server requesting the action from an authenticated and valid API request. Essentially, this is like a root level vulnerability for an entire Kubernetes cluster.

The concern with the vulnerability is that they show as properly authorized actions in logs. On most clusters, it will be nearly impossible to distinguish a legitimate API call versus one exploiting the CVE-2018-1002105 vulnerability. Looking like a normal entry in a log will not trigger alarms in monitoring software, and can make forensic investigation difficult to see if this privilege escalation vulnerability was used.

Resources for More on CVE-2018-1002105

Here are a few resources for those who are running Kubernetes and want to know more. Major vendors have already patched this vulnerability but if you are not updating components regularly, they will be worth a read.

There is a lot more out there on the vulnerability. It is a big one that was responsibly disclosed by a Rancher Labs executive and the community has done a great job mitigating.


Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.