CVE-2024-5321: Incorrect permissions on Windows containers logs
A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.30.3 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.29.7 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.28.12 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.27.16
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5321?
CVE-2024-5321 is categorized as a medium severity vulnerability due to incorrect permissions in Windows containers.
How do I fix CVE-2024-5321?
To resolve CVE-2024-5321, upgrade to Kubernetes version 1.30.3, 1.29.7, 1.28.12, or ensure you are not using versions prior to 1.27.16.
Who is affected by CVE-2024-5321?
CVE-2024-5321 affects Kubernetes clusters that utilize Windows nodes with improper log access permissions.
What can happen if CVE-2024-5321 is exploited?
Exploitation of CVE-2024-5321 could allow unauthorized users to read or modify container logs in Windows environments.
Is CVE-2024-5321 specific to certain Kubernetes versions?
Yes, CVE-2024-5321 specifically affects Kubernetes versions from 1.27.16 and earlier up to 1.30.3.