CVE-2024-0793: Kube-controller-manager: malformed hpa v1 manifest causes crash
A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.
Other sources
The problem in particular is with the annotation " autoscaling.alpha.kubernetes.io/behavior" when it doesn't have a definition for scaling up, The cluster accepts the manifest but it seems that it fills with "nil" the scale up portion and it causes the kube-controller-manager pods to crash and go into crashloopbackoff.
The logs of the kube-controller-manager component show an error referencing invalid memory address or nil pointer dereference which causes the pod to die.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.27.0-alpha.1
Event History
Frequently Asked Questions
What level of access is needed to trigger the failure?
An attacker needs privileges to initially apply an HPA configuration YAML to the cluster. The affected manifest includes the autoscaling.alpha.kubernetes.io/behavior annotation without a scaling-up definition.
Which environments are exposed?
Clusters are exposed when kube-controller-manager processes an initially applied HPA manifest with the malformed behavior configuration. The provided data does not establish whether any default configuration creates such a manifest.
How can administrators tell whether this is occurring?
Affected kube-controller-manager pods enter restart churn or CrashLoopBackOff. Their logs show an error referring to an invalid memory address or nil pointer dereference before the pod dies.