Description
A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.11 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubernetes | 1.29.1-2 | — |
| Azure Linux 2 (CBL-Mariner) | kubernetes | 1.28.4-5 | — |
Advisories 1
- WID-SEC-2023-2566 Red Hat OpenShift: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jan 1, 2024
References
- RHSA-2023:5006 vendor-advisory
- RHSA-2023:6130 vendor-advisory
- RHSA-2023:6842 vendor-advisory
- RHSA-2023:7479 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-5408 vdb-entry
- RHBZ#2242173 issue-tracking
- https://github.com/openshift/kubernetes/pull/1736