Executive brief
A vulnerability in the Kubernetes networking component for Windows could allow network traffic to be misdirected to unintended local processes. This occurs when specific load balancer settings are missing, potentially allowing an attacker with high privileges to intercept data intended for legitimate services. This could lead to unauthorized access to sensitive information within the cluster environment.
Technical details
A traffic misdirection vulnerability exists in kube-proxy on Windows nodes. The issue occurs when a LoadBalancer Service is created but the LoadBalancer controller fails to populate the `status.loadBalancer.ingress[].ip` field. In this scenario, kube-proxy may unintentionally forward traffic to local processes listening on the same port defined in `spec.ports[*].port`. Exploitation requires high privileges and specific network configurations (high complexity), but can result in a scope change allowing an attacker to intercept traffic. The issue is resolved in Kubernetes version 1.21.0.
Affected products
- Kubernetes kubernetes < 1.21.0
Timeline
- 2023-10-30: advisory
- 2023-10-30: disclosed
- 2021-04-08: patched: Based on Kubernetes 1.21.0 release date and commit history