Skip to content
OpenAdvisories
High ELSA-2020-5765 9 CVEs

Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne security update (Oracle Linux 7)

Published Jul 22, 2020 · Updated Jul 22, 2020

Ecosystem: Oracle Linux

Summary

kernel-uek-container
[4.14.35-1902.303.5.3.el7]
- rds: Deregister all FRWR mr with free_mr (Hans Westgaard Ry) [Orabug: 31476202]
- Revert 'rds: Do not cancel RDMAs that have been posted to the HCA' (Gerd Rausch) [Orabug: 31475329]
- Revert 'rds: Introduce rds_conn_to_path helper' (Gerd Rausch) [Orabug: 31475329]
- Revert 'rds: Three cancel fixes' (Gerd Rausch) [Orabug: 31475318]

[4.14.35-1902.303.5.2.el7]
- rds: Three cancel fixes (Hakon Bugge) [Orabug: 31463014]

[4.14.35-1902.303.5.1.el7]
- x86/speculation: Add SRBDS vulnerability and mitigation documentation (Mark Gross) [Orabug: 31446720] {CVE-2020-0543}
- x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Mark Gross) [Orabug: 31446720] {CVE-2020-0543}
- x86/cpu: Add 'table' argument to cpu_matches() (Mark Gross) [Orabug: 31446720] {CVE-2020-0543}
- x86/cpu: Add a steppings field to struct x86_cpu_id (Mark Gross) [Orabug: 31446720] {CVE-2020-0543}

[4.14.35-1902.303.5.el7]
- net/mlx5: Decrease default mr cache size (Artemy Kovalyov) [Orabug: 31446379]

[4.14.35-1902.303.4.el7]
- net/rds: suppress memory allocation failure reports (Manjunath Patil) [Orabug: 31422157]
- rds: Do not cancel RDMAs that have been posted to the HCA (Hakon Bugge) [Orabug: 31422151]
- rds: Introduce rds_conn_to_path helper (Hakon Bugge) [Orabug: 31422151]

kata-image
[1.7.3-1.0.5.1]
- Address Kata CVE 2023

kata-runtime
[1.7.3-1.0.5]
- Address Kata CVE-2020-2023
- Address Kata CVE-2020-2024
- Address Kata CVE-2020-2025
- Address Kata CVE-2020-2026

kata
[1.7.3-1.0.7]
- Address CVE-2020-2023
- Address CVE-2020-2024
- Address CVE-2020-2025
- Address CVE-2020-2026

kubernetes
[1.14.9-1.0.6]
- CVE-2020-8559: Privilege escalation from compromised node to cluster
- CVE-2020-8557: Node disk DOS by writing to container /etc/hosts

[1.14.9-1.0.5]
- Update dependency on Kata containers to a build that includes fixes for CVE-2020-2023 thru CVE-2020-2026

kubernetes
[1.17.9-1.0.1.el7]
- Added Oracle specific build files for Kubernetes

istio
[1.4.10-1.0.1]
- CVE-2020-15104:
Incorrect validation of wildcard DNS Subject Alternative Names

[1.4.10-1.0.0]
- Added Oracle Specific Build Files for istio/istio

olcne
[1.1.2-6]
- Include kata-runtime in the default template

[1.1.2-5]
- CVE-2020-8559: Privilege escalation from compromised node to cluster
- CVE-2020-8557: Node disk DOS by writing to container /etc/hosts

[1.1.2-4]
- Update arguments added for istio module.

[1.1.2-3]
- Ensure Istio sidecar injector uses valid executable

[1.1.2-2]
- Update Kubernetes to use Kata 1.7.3-1.0.7 to address CVE-2020-2023 thru CVE-2020-2026

[1.1.2-1]
- Added istio-1.4.10 charts and updated istio.yaml to use istio-1.4.10

Fixed packages 25

ReleasePackageFixed in
Oracle Linux · 7 istio 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-citadel 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-galley 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-istioctl 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-mixc 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-mixs 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-node-agent 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-pilot-agent 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-pilot-discovery 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-proxy-init 0:1.4.10-1.0.1.el7
Oracle Linux · 7 istio-sidecar-injector 0:1.4.10-1.0.1.el7
Oracle Linux · 7 kata 0:1.7.3-1.0.7.el7
Oracle Linux · 7 kata-image 0:1.7.3-1.0.5.1.ol7_202007011859
Oracle Linux · 7 kata-runtime 0:1.7.3-1.0.5.el7
Oracle Linux · 7 kernel-uek-container 0:4.14.35-1902.303.5.3.el7
Oracle Linux · 7 kubeadm 0:1.17.9-1.0.1.el7
Oracle Linux · 7 kubectl 0:1.17.9-1.0.1.el7
Oracle Linux · 7 kubelet 0:1.17.9-1.0.1.el7
Oracle Linux · 7 olcne-agent 0:1.1.2-6.el7
Oracle Linux · 7 olcne-api-server 0:1.1.2-6.el7
Oracle Linux · 7 olcne-istio-chart 0:1.1.2-6.el7
Oracle Linux · 7 olcne-nginx 0:1.1.2-6.el7
Oracle Linux · 7 olcne-prometheus-chart 0:1.1.2-6.el7
Oracle Linux · 7 olcne-utils 0:1.1.2-6.el7
Oracle Linux · 7 olcnectl 0:1.1.2-6.el7

Vulnerabilities 9

  • High 8.8
    CVE-2020-2025

    Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file

    Kata Containers before 1.11.0 on Cloud Hypervisor persists guest filesystem changes to the underlying image file on the host. A malicious guest can overwrite the image file to gain control of all subsequent guest VMs. Since Kata Containers uses the same VM im…

    kata-containers kata-containers
  • High 8.6
    CVE-2020-1764 Public exploit

    Hard coded cryptographic key in Kiali

    A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possib…

    Red Hat kiali github.com/kiali/kiali Go
  • High 7.8
    CVE-2020-2026

    Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path

    A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code executi…

    kata-containers kata-containers github.com/kata-containers/runtime Go
  • High 7.5
    CVE-2020-10739

    Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled:…

    istio.io istio/envoy
  • Medium 6.5
    CVE-2020-2024

    Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host

    An improper link resolution vulnerability affects Kata Containers versions prior to 1.11.0. Upon container teardown, a malicious guest can trick the kata-runtime into unmounting any mount point on the host and all mount points underneath it, potentiality resu…

    kata-containers kata-containers
  • Medium 6.4
    CVE-2020-8559 Public exploit

    Privilege escalation from compromised node to cluster

    The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a ful…

    Kubernetes Kubernetes zot kots Debian Alpine Wolfi Go
  • Medium 5.5
    CVE-2020-8557

    Kubernetes node disk Denial of Service by writing to container /etc/hosts

    The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction m…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go
  • Medium 4.6
    CVE-2020-15104

    TLS Validation Vulnerability in Envoy

    In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly…

    envoyproxy envoy
  • Low 3.7
    CVE-2020-11080

    Denial of service in nghttp2

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

    nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine