Executive brief
Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. A vulnerability exists where the system's security checks can be bypassed, potentially allowing an attacker to access private internal networks on the control plane. This could lead to unauthorized access to sensitive internal services or data that should otherwise be restricted.
Technical details
A Time-of-Check Time-of-Use (TOCTOU) vulnerability exists in Kubernetes' proxy IP restriction logic. When making user-driven connections to Services, Pods, Nodes, or StorageClass providers, Kubernetes performs an initial DNS resolution to validate that the resulting IP is not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. However, it then performs a second, unvalidated DNS resolution for the actual connection. An attacker using a malicious DNS server can return a safe IP for the first check and a restricted IP for the second, bypassing the mitigation. This requires network access and low privileges. At the time of advisory, no fix was available.
Affected products
- Kubernetes Kubernetes <= 1.18.19, 1.19.0-1.19.11, 1.20.0-1.20.7, 1.21.0-1.21.1
Timeline
- 2022-02-01: disclosed: NVD publication date
- 2022-02-02: advisory: GitHub Advisory published