CVE-2023-1260: Kube-apiserver: privesc
''' We've discovered a privilege escalation issue in the OpenShift platform.
Conditions for the privilege escalation: - a user must be granted the ability to "update, patch" the "pods/ephemeralcontainers" subresource - by default, NEITHER common users NOR Service Accounts are granted this permission by the platform - with the above permission, a user is able to patch a running pod they've got access to and bypass SCC admission - this means, a user can create a "privileged" container, which allows them obtaining access to the pod's node resources
The step-by-step reproducer is described in https://issues.redhat.com/browse/OCPBUGS-7181.
Affected OpenShift Container Platform versions: 4.10 and newer. Affected component: kube-apiserver (and the platforms that use it)
The bug is located within the apiserver-library-go repository in the following module: https://github.com/openshift/apiserver-library-go/tree/master/pkg/securitycontextconstraints. We are yet to determine how to fix it.
The workaround is to remove the permissions to "update, patch" the "pods/ephemeralcontainers" subresource from any low-privileged users, if there are any that currently hold it. '''
From Stanislav Láznička
Other sources
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-1260?
The severity of CVE-2023-1260 is critical, with a severity value of 9.1.
How does CVE-2023-1260 affect kube-apiserver?
CVE-2023-1260 is an authentication bypass vulnerability that affects kube-apiserver.
Who is affected by CVE-2023-1260?
Users of Kubernetes kube-apiserver and Redhat Openshift Container Platform versions 4.10, 4.11, 4.12, and 4.13 are affected by CVE-2023-1260.
What is the remedy for CVE-2023-1260 in github.com/openshift/apiserver-library-go?
The remedy for CVE-2023-1260 in github.com/openshift/apiserver-library-go is version 0.0.0-20230621.
Are there any references related to CVE-2023-1260?
Yes, you can find more information about CVE-2023-1260 in the following references: [RHSA-2023:3976](https://access.redhat.com/errata/RHSA-2023:3976), [RHSA-2023:4093](https://access.redhat.com/errata/RHSA-2023:4093), [RHSA-2023:4312](https://access.redhat.com/errata/RHSA-2023:4312).