CVE-2023-33191: kyverno seccomp control can be circumvented
Impact
Users of the podSecurity (validate.podSecurity) subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a version value of latest. There is no effect if a version number is referenced instead. See the documentation for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected.
Patches
v1.9.4 v1.10.0
Workarounds
To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline here and restricted here.
References
https://kyverno.io/docs/writing-policies/validate/#pod-security https://github.com/kyverno/kyverno/pull/7263
Other sources
Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity validate.podSecurity subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/kyverno/kyvernoto a version that resolves this vulnerability.Fixed in 1.9.4 - Upgrade
Upgrade
kyvernoto a version that resolves this vulnerability.Fixed in 1.9.4 - Configuration
Avoid using `version: latest` in the podSecurity `validate.podSecurity` subrule in Kyverno v1.9.2/v1.9.3; use a specific version instead so the Seccomp control check can be enforced at the baseline level.
Kyverno podSecurity validate.podSecurity subrule version = not "latest" (use a specific version) - Compensating control
If you cannot upgrade to v1.9.4, temporarily install the individual Seccomp-related policies: baseline `restrict-seccomp` and restricted `restrict-seccomp-strict` from Kyverno policy links cited in the material, to work around the inability to enforce the Seccomp check in Kyverno v1.9.2/v1.9.3.
Event History
Frequently Asked Questions
What is the impact of CVE-2023-33191?
Users of the podSecurity subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a version value of latest.
How can I mitigate CVE-2023-33191?
Upgrade to Kyverno version 1.9.4 or later.