CVE-2021-25736: Windows kube-proxy LoadBalancer contention
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.
Other sources
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (spec.ports[].port) as a LoadBalancer Service when the LoadBalancer controller does not set the status.loadBalancer.ingress[].ip field. Clusters where the LoadBalancer controller sets the status.loadBalancer.ingress[].ip field are unaffected.
— GitHub
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25736?
The severity of CVE-2021-25736 is medium, with a severity value of 5.8.
How does CVE-2021-25736 affect Windows kube-proxy?
CVE-2021-25736 affects Windows kube-proxy by unintentionally forwarding traffic to local processes listening on the same port as a LoadBalancer Service when the LoadBalancer controller does not set the 'status.loadBalancer.ingress[].ip' field.
Which version of k8s.io/kubernetes is affected by CVE-2021-25736?
CVE-2021-25736 affects version up to, but not including, 1.21 of k8s.io/kubernetes.
How can I fix CVE-2021-25736?
To fix CVE-2021-25736, update to a version of k8s.io/kubernetes that is 1.21 or newer.
Where can I find more information about CVE-2021-25736?
You can find more information about CVE-2021-25736 at the following references: [link1], [link2], [link3].