CVE-2017-1002102
First published: Tue Mar 06 2018(Updated: )
A symlink race in the openShift node process allows a malicious container to trick the node into deleting any file. Every sync iteration, the atomic writer code walks the volume looking for files that shouldn't be there or files that have changed. When it finds files that shouldn't be there, it adds them to a list. Once it's finished walking the tree, it sorts the list lexicographically then starts at the end (to make sure that files are removed before the directories that contain them) and removes them one by one. Because (a) the volume isn't mounted read-only by the runtime and (b) there is a time between finding the file and deleting the file, a malicious container can set up conditions to win a race such that the file to be deleted is removed and replaced with a symlink (to a node file to be deleted) between the time that the kubelet finds the file and the time it deletes it.
Credit: jordan@liggitt.net jordan@liggitt.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/k8s.io/kubernetes | >=1.3.0<=1.7.13 | 1.7.14 |
| go/k8s.io/kubernetes | >=1.9.0<=1.9.3 | 1.9.4 |
| go/k8s.io/kubernetes | >=1.8.0<=1.8.8 | 1.8.9 |
| Kubernetes Kubernetes | >=1.3.0<=1.3.10 | |
| Kubernetes Kubernetes | >=1.4.0<=1.4.12 | |
| Kubernetes Kubernetes | >=1.5.0<=1.5.8 | |
| Kubernetes Kubernetes | >=1.6.0<=1.6.13 | |
| Kubernetes Kubernetes | >=1.7.0<1.7.14 | |
| Kubernetes Kubernetes | >=1.8.0<1.8.9 | |
| Kubernetes Kubernetes | >=1.9.0<1.9.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2017-1002102
- https://github.com/kubernetes/kubernetes/issues/60814
- https://access.redhat.com/errata/RHSA-2018:0475
- https://github.com/advisories/GHSA-mm7g-f2gg-cw8g (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1554539
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1554573
- https://access.redhat.com/security/cve/cve-2017-1002102
- https://bugzilla.redhat.com/show_bug.cgi?id=1551818
Frequently Asked Questions
What is CVE-2017-1002102?
CVE-2017-1002102 is a vulnerability in Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x, and prior to versions 1.7.14, 1.8.9, and 1.9.4.
How does CVE-2017-1002102 affect Kubernetes?
CVE-2017-1002102 allows containers using a secret, configMap, projected, or downwardAPI volume to trigger the deletion of arbitrary files/directories from the nodes where they are running.
What is the severity of CVE-2017-1002102?
CVE-2017-1002102 has a severity value of 5.6, which is considered high.
Which versions of Kubernetes are affected by CVE-2017-1002102?
Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x, and versions prior to 1.7.14, 1.8.9, and 1.9.4 are affected by CVE-2017-1002102.
How can I mitigate CVE-2017-1002102 in Kubernetes?
To mitigate CVE-2017-1002102, make sure to update Kubernetes to version 1.7.14, 1.8.9, or 1.9.4.
- collector/github-advisory-latest
- alias/GHSA-mm7g-f2gg-cw8g
- alias/CVE-2017-1002102
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/author
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- agent/tags
- agent/severity
- agent/weakness
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- package-manager/go
- vendor/kubernetes
- canonical/kubernetes kubernetes
- version/kubernetes kubernetes/1.3.0
- version/kubernetes kubernetes/1.3.10
- version/kubernetes kubernetes/1.4.0
- version/kubernetes kubernetes/1.4.12
- version/kubernetes kubernetes/1.5.0
- version/kubernetes kubernetes/1.5.8
- version/kubernetes kubernetes/1.6.0
- version/kubernetes kubernetes/1.6.13
- version/kubernetes kubernetes/1.7.0
- version/kubernetes kubernetes/1.8.0
- version/kubernetes kubernetes/1.9.0