CVE-2023-1260
Description
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8 | 8 | 8 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | High | High |
| Privileges Required | High | High | High |
| User Interaction | None | None | None |
| Scope | Changed | Changed | Changed |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Privileges required is rated high as a potential attacker must already have an account with permissions beyond the defaults.
There are two scenarios for exploitation: creating a new pod or patching an existing one. In both scenarios the allocation of additional resources can be detected quite easily. If there were a significant amount of change to computing resources in use then it is reasonable to assume that system administrators would notice this, raise suspicion, and interrupt this activity. Long term exploitation would require significant subtlety or chaining of additional vulnerabilities.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Acknowledgements
This issue was discovered by Xingxing Xia (Red Hat).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
