CVE-2018-1002105

Impact:
Critical
Public Date:
2018-12-03
CWE:
CWE-305
Bugzilla:
1648138: CVE-2018-1002105 kubernetes: authentication/authorization bypass in the handling of non-101 responses
A privilege escalation vulnerability exists in OpenShift Container Platform which allows for compromise of pods running co-located on a compute node. This access could include access to all secrets, pods, environment variables, running pod/container processes, and persistent volumes, including in privileged containers.

Find out more about CVE-2018-1002105 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

In versions 3.6 and higher of OpenShift Container Platform, this vulnerability allows cluster-admin level access to any API hosted by an aggregated API server. This includes the ‘service catalog’ API which is installed by default in 3.7 and later. Cluster-admin level access to the service catalog allows creation of brokered services by an unauthenticated user with escalated privileges in any namespace and on any node. This could lead to an attacker being allowed to deploy malicious code, or alter existing services.

CVSS v3 metrics

CVSS3 Base Score 9.8
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity Impact High
Availability Impact High

Red Hat Security Errata

Platform Errata Release Date
Red Hat OpenShift Container Platform 3.11 (atomic-openshift) RHSA-2018:3537 2018-11-20
Red Hat OpenShift Container Platform 3.2 (atomic-openshift) RHSA-2018:3742 2018-12-03
Red Hat OpenShift Container Platform 3.6 (atomic-openshift) RHSA-2018:3598 2018-12-03
Red Hat OpenShift Container Platform 3.4 (atomic-openshift) RHSA-2018:3752 2018-12-03
Red Hat OpenShift Container Platform 3.5 (atomic-openshift) RHSA-2018:3624 2018-12-03
Red Hat OpenShift Container Platform 3.3 (atomic-openshift) RHSA-2018:3754 2018-12-03
Red Hat OpenShift Container Platform 3.8 (atomic-openshift) RHSA-2018:3551 2018-11-19
Red Hat OpenShift Container Platform 3.9 (atomic-openshift) RHSA-2018:2908 2018-11-20
Red Hat OpenShift Container Platform 3.7 (atomic-openshift) RHSA-2018:2906 2018-11-21
Red Hat OpenShift Container Platform 3.10 (atomic-openshift) RHSA-2018:3549 2018-11-20

Affected Packages State

Platform Package State
Red Hat OpenShift Enterprise 3.1 atomic-openshift Will not fix
Red Hat OpenShift Enterprise 3.0 atomic-openshift Will not fix

Acknowledgements

Red Hat would like to thank the Kubernetes Product Security Team for reporting this issue. Upstream acknowledges Darren Shepherd as the original reporter.

Mitigation

See the vulnerability article for mitigation procedures.

External References

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.