CVE-2021-25749: runAsNonRoot logic bypass for Windows containers
A flaw was found in Kubernetes. This issue allows Windows workloads to run as a ContainerAdministrator even when the workloads set the runAsNonRoot option to true.
Other sources
A security issue was discovered in Kubernetes that could allow Windows workloads to run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
ref: https://github.com/rancher/rancher/issues/38949
— Red Hat
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-25749.
What is the affected software?
The affected software is Kubernetes with versions between 1.20.0 and 1.24.5.
What is the severity of CVE-2021-25749?
The severity of CVE-2021-25749 is high.
How does this vulnerability affect Windows workloads in Kubernetes?
This vulnerability allows Windows workloads to run as a ContainerAdministrator even when the workloads set the runAsNonRoot option to true.
How can I fix CVE-2021-25749?
To fix CVE-2021-25749, update Kubernetes to version 1.25.0 or apply the necessary patches provided by Red Hat.