CVE-2020-8558: Kubernetes node setting allows for neighboring hosts to bypass localhost boundary
A flaw was found in Kubernetes that allows attackers on adjacent networks to reach services exposed on localhost ports, previously thought to be unreachable. This flaw allows an attacker to gain privileges or access confidential information for any services listening on localhost ports that are not protected by authentication.
Other sources
Kubernetes' kube-proxy enables net.ipv4.conf.all.routelocalnet by default on all nodes. This allows neighbouring hosts on the local network to reach ports on Kubernetes nodes that are only exposed on localhost.
— Red Hat
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/atomic-openshiftto a version that resolves this vulnerability.Fixed in 0:3.11.248-1.git.0.92ee8ac.el7 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.3.31-202007280738.p0.git.0.9884401.el7 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.4.0-202007090832.p0.git.0.bc32fb1.el8 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.5.0-202007012112.p0.git.0.582d7fc.el7 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.19.0 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.18.4 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.17.7 - Upgrade
Upgrade
kubernetes/kubelet and kubernetes/kube-proxyto a version that resolves this vulnerability.Fixed in 1.17.7 - Upgrade
Upgrade
kubernetes/kubelet and kubernetes/kube-proxyto a version that resolves this vulnerability.Fixed in 1.18.4 - Configuration
Disable the kube-proxy behavior that enables route_localnet by ensuring net.ipv4.conf.all.route_localnet is not enabled on Kubernetes nodes (set to 0) so adjacent hosts cannot route to localhost-bound (127.0.0.1) services.
Kubernetes kube-proxy (net.ipv4.conf.all.route_localnet) net.ipv4.conf.all.route_localnet = disable (set to 0)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Kubernetes flaw?
The vulnerability ID for this flaw in Kubernetes is CVE-2020-8558.
What is the severity of CVE-2020-8558?
CVE-2020-8558 has a severity of 5.4, which is considered medium.
How does CVE-2020-8558 impact Kubernetes?
CVE-2020-8558 allows attackers on adjacent networks to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace.
Which versions of Kubernetes are affected by CVE-2020-8558?
Versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 of Kubernetes are affected by CVE-2020-8558.
How can I fix CVE-2020-8558 in Kubernetes?
To fix CVE-2020-8558 in Kubernetes, update to version 1.19.0, 1.18.4, or 1.17.7, depending on your current version.