CVE-2024-48921: Kyverno's PolicyException objects can be created in any namespace by default
Summary A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace.
Details By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions.
PoC 1. Administrator creates "disallow-privileged-containers" ClusterPolicy that applies to resources in the namespace "ubuntu-restricted" 2. Cluster user creates a PolicyException object for "disallow-privileged-containers" in namespace "ubuntu-restricted" 3. Cluster user creates a pod with a privileged container in "ubuntu-restricted" 4. Cluster user escalates to root on the node from the privileged container
Impact Administrators attempting to enforce cluster security through kyverno policies, but that allow less privileged users to create resources
Other sources
Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48921?
CVE-2024-48921 has been classified with a severity that may allow privilege escalation in Kubernetes environments.
How does CVE-2024-48921 affect Kyverno policies?
CVE-2024-48921 allows PolicyExceptions to override the "disallow-privileged-containers" ClusterPolicy in any namespace.
What versions of Kyverno are affected by CVE-2024-48921?
CVE-2024-48921 affects Kyverno versions up to but not including 1.13.0.
How can I mitigate the risks associated with CVE-2024-48921?
To mitigate CVE-2024-48921, upgrade your Kyverno instance to version 1.13.0 or later.
What should administrators be aware of regarding CVE-2024-48921?
Administrators should be aware that CVE-2024-48921 allows users to create PolicyExceptions across random namespaces, potentially bypassing security policies.