CVE-2021-25737: Holes in EndpointSlice Validation Enable Host Network Hijack
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
Other sources
A security issue was discovered in Kubernetes where an authorized user may be able to redirect traffic to private networks on a Node. An untrusted user could exploit this by creating or modifying EndpointSlices to point to localhost or link-local addresses.
A security issue was discovered in Kubernetes where an authorized user may be able to redirect traffic to private networks on a Node. Kubernetes clusters are only affected if an untrusted user can create or modify EndpointSlices. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.21.1 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.20.7 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.19.11 - Upgrade
Upgrade
redhat/kubernetesto a version that resolves this vulnerability.Fixed in 1.18.19 - Compensating control
Create a validating admission webhook for EndpointSlices that rejects EndpointSlice endpoint addresses in the 127.0.0.0/8 (localhost) and 169.254.0.0/16 (link-local) ranges.
- Compensating control
Prevent untrusted users from creating or modifying EndpointSlices by restricting permissions/authorization so only trusted users can manage EndpointSlices.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-25737?
The severity of CVE-2021-25737 is medium.
How can an authorized user exploit CVE-2021-25737?
An authorized user can exploit CVE-2021-25737 by redirecting pod traffic to private networks on a Node.
What software versions are affected by CVE-2021-25737?
The following software versions are affected by CVE-2021-25737: Kubernetes 1.21.1, Kubernetes 1.20.7, Kubernetes 1.19.11, Kubernetes 1.18.19, OpenShift 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8.
How do I fix CVE-2021-25737?
To fix CVE-2021-25737, update your Kubernetes or OpenShift software to the appropriate remediation version: Kubernetes 1.21.1, Kubernetes 1.20.7, Kubernetes 1.19.11, Kubernetes 1.18.19, OpenShift 4.8.0-202107161820.p0.git.051ac4f.assembly.stream.el8.
Where can I find more information about CVE-2021-25737?
You can find more information about CVE-2021-25737 at the following references: [1] GitHub: https://github.com/kubernetes/kubernetes/pull/101084 [2] Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1962296 [3] Red Hat Advisory: https://access.redhat.com/errata/RHSA-2021:2437