CVE-2023-5056: Skupper-operator: privelege escalation via config map
A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.
Other sources
The latest skupper operator allows privilege escalation on a kubernetes cluster. If the skupper operator is running and a user in a given namespace creates a ConfigMap with the name skupper-site and includes in the data the line, cluster-permissions: "true", then the operator will create a service account in that namespace that has cluster permissions enabling it to watch deployments in all namespaces on the cluster. This is the case even if the user creating that ConfigMap does not themselves have access to other namespaces.
The solution we propose is to make this feature optional at the operator level, and off by default. We have a patch ready for this (it has not been shared outside relevant Red Hat engineers) but want to be sure we follow the correct process.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5056?
CVE-2023-5056 has been categorized with a significant severity due to its potential impact on the confidentiality of deployments.
How do I fix CVE-2023-5056?
To fix CVE-2023-5056, review and adjust the service account configurations in the Skupper operator to limit unauthorized access.
Who is affected by CVE-2023-5056?
CVE-2023-5056 affects users of Red Hat Service Interconnect 1.0 on Red Hat Enterprise Linux 9.0.
What kind of information can be accessed due to CVE-2023-5056?
Due to CVE-2023-5056, an authenticated attacker can view all deployments across namespaces in the cluster.
Is there a workaround for CVE-2023-5056?
Currently, there are no official workarounds for CVE-2023-5056, and it is recommended to apply the fix as soon as available.