CVE-2024-3177: Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated.
Affected Versions
Kubernetes < 1.27.12 Kubernetes < 1.28.8 Kubernetes < 1.29.3
Other sources
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.
— NVD
Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.28.9 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.29.4 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.27.13 - Upgrade
Upgrade
redhat/Kubernetesto a version that resolves this vulnerability.Fixed in 1.27.13 - Upgrade
Upgrade
redhat/Kubernetesto a version that resolves this vulnerability.Fixed in 1.28.9 - Upgrade
Upgrade
redhat/Kubernetesto a version that resolves this vulnerability.Fixed in 1.29.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.30.1-1 - Upgrade
Upgrade
kubernetes/kubernetesto a version that resolves this vulnerability.Fixed in 1.27.12 - Upgrade
Upgrade
kubernetes/kubernetesto a version that resolves this vulnerability.Fixed in 1.28.8 - Upgrade
Upgrade
kubernetes/kubernetesto a version that resolves this vulnerability.Fixed in 1.29.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3177?
CVE-2024-3177 has been classified as a medium severity vulnerability.
How do I fix CVE-2024-3177?
To remediate CVE-2024-3177, upgrade Kubernetes to version 1.28.9, 1.29.4, or 1.27.13, depending on your current version.
What does CVE-2024-3177 affect?
CVE-2024-3177 affects Kubernetes users who are utilizing the ServiceAccount admission plugin with containers, init containers, and ephemeral containers.
Can CVE-2024-3177 allow unauthorized access?
Yes, CVE-2024-3177 can enable users to bypass the mountable secrets policy, potentially leading to unauthorized access.
Is CVE-2024-3177 present in earlier versions of Kubernetes?
Yes, CVE-2024-3177 affects versions of Kubernetes prior to 1.28.9, 1.29.4, or 1.27.13 and needs updating to mitigate.