CVE-2020-8554: Kubernetes man in the middle using LoadBalancer or ExternalIPs
A flaw was found in kubernetes. If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods (or nodes) in the cluster.
Other sources
A security issue was discovered with Kubernetes affecting multitenant clusters. If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods (or nodes) in the cluster.
— Red Hat
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/atomic-openshiftto a version that resolves this vulnerability.Fixed in 0:3.11.374-1.git.0.ebd3ee9.el7 - Configuration
In OCP 3.11, change externalIPNetworkCIDR to "0.0.0.0/32" to block all externalIP address values and prevent traffic interception via externalIPs.
OpenShift Container Platform (OCP) 3.11 externalIPNetworkCIDR = 0.0.0.0/32 - Configuration
In OCP 4, ensure cluster-admins only whitelist specific externalIP addresses as needed (default is secure) to reduce risk of traffic interception via externalIPs.
OpenShift Container Platform (OCP) 4 externalIPNetworkCIDR = allowed externalIP addresses (whitelist) - Compensating control
Check whether you are allowed to patch the status of a LoadBalancer service using: kubectl auth can-i patch service --subresource=status. If not required, remove/grant-less this privileged permission to prevent setting status.loadBalancer.ingress.ip to attacker-controlled values.
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in Kubernetes?
The vulnerability ID is CVE-2020-8554.
What is the severity of CVE-2020-8554?
The severity of CVE-2020-8554 is medium (6.3).
How can an attacker exploit CVE-2020-8554?
An attacker can exploit CVE-2020-8554 by creating a ClusterIP service and setting the spec.externalIPs field to intercept traffic.
Which versions of Kubernetes are affected by CVE-2020-8554?
All versions of Kubernetes are affected by CVE-2020-8554.
Where can I find more information about CVE-2020-8554?
You can find more information about CVE-2020-8554 in the references provided.