Description
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | 1.15, 1.14, 1.13, 1.12, 1.11, 1.10, 1.9, 1.8, 1.7, 1.6, 1.5, 1.4, 1.3, 1.2, 1.1, 1.18 – < 1.18.6, 1.17 – < 1.17.9, 1.16 – < 1.16.13 | 1.18.6 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.18.5-1 | — |
| Debian 13 | kubernetes | 1.18.5-1 | — |
| Debian 12 | kubernetes | 1.18.5-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.235.2.1597312414-1.el7 | RHSA-2020:3808, RHSA-2020:3519 |
| Red Hat OpenShift 4 | openshift +1 | 4.3.37-202009120213.p0.git.0.dffefe4.el8 | RHSA-2020:3808, RHSA-2020:3579, RHSA-2020:3519 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.542-1.git.0.f2fd300.el7 | RHSA-2021:3915 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | kubernetes | 1.17.4-4.18.1 | SUSE-RU-2020:2204-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.23 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.22 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.21 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.20 | k3s | 1.18.6.1-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.18 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.17 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.16 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.15 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.14 | k3s | 1.18.6.1-r0 | — |
| Alpine v3.13 | k3s | 1.18.6.1-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | istio +10 | 1.4.10-1.0.1.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | kata | 1.7.3-1.0.7.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kata-image | 1.7.3-1.0.5.1.ol7_202007011859 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kata-runtime | 1.7.3-1.0.5.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kernel-uek-container | 4.14.35-1902.303.5.3.el7 | ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | kubeadm +2 | 1.12.10-1.0.13.el7 | ELSA-2020-5767, ELSA-2020-5766, ELSA-2020-5765 |
| Oracle Linux 7 | olcne-istio-chart +1 | 1.1.2-6.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | olcnectl +4 | 1.0.5-3.el7 | ELSA-2020-5766, ELSA-2020-5765 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.1.0, < 1.16.13 · >= 1.17.0, < 1.17.9 · >= 1.18.0, < 1.18.6 | 1.16.13, 1.17.9, 1.18.6 | GO-2024-2753 |
| Go | k8s.io/kubernetes/pkg/kubelet | >= 1.1.0, < 1.16.13 | 1.16.13 | GHSA-55qj-gj3x-jq9r |
| Go | k8s.io/kubernetes/pkg/kubelet | >= 1.17.0, < 1.17.9 | 1.17.9 | GHSA-55qj-gj3x-jq9r |
| Go | k8s.io/kubernetes/pkg/kubelet | >= 1.18.0, < 1.18.6 | 1.18.6 | GHSA-55qj-gj3x-jq9r |
Advisories 10
- RHSA-2020:3579 Red Hat Security Advisory: OpenShift Container Platform 4.4.19 openshift security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:3808 Red Hat Security Advisory: OpenShift Container Platform 4.3.38 jenkins and openshift security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:3519 Red Hat Security Advisory: OpenShift Container Platform 4.5.7 jenkins and openshift packages security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-RU-2020:2204-1 Bugfixes on cilium, gangway and skuba and security fix for Kubernetes (cve-2020-8557) SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2021:3915 Red Hat Security Advisory: OpenShift Container Platform 3.11.542 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2020-5765 Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2020
- ELSA-2020-5766 Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2020
- ELSA-2020-5767 Important: kubernetes security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2020