REDHAT-BUG-1730161: Medium severity red hat openshift container platform for ibm linuxone vulnerability

Published Jul 16, 2019

Updated

In the default configuration, OpenShift Container Platform 4 allows users with access to create pods the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. Pod access to the host network can be granted with the hostnetwork SCC.

Original Bug:

https://bugzilla.redhat.com/showbug.cgi?id=1729242

Upstream Fix:

https://github.com/openshift/cluster-kube-apiserver-operator/pull/524

Affected Software

1 affected component

Red Hat OpenShift Container Platform

Event History

Jul 16, 2019

Data Sourced

via Red Hat·02:59 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1730161?

The severity of REDHAT-BUG-1730161 is considered critical due to the potential of unauthorized access to sensitive AWS IAM roles.

How do I fix REDHAT-BUG-1730161?

To fix REDHAT-BUG-1730161, adjust the security context constraints to restrict pod scheduling on master nodes.

Who is affected by REDHAT-BUG-1730161?

REDHAT-BUG-1730161 affects users of the OpenShift Container Platform 4 with permissions to create pods.

What are the implications of REDHAT-BUG-1730161?

The implications of REDHAT-BUG-1730161 include potential exposure of sensitive security credentials and elevated privileges for unauthorized users.

What can I do to mitigate REDHAT-BUG-1730161 before a fix is available?

To mitigate REDHAT-BUG-1730161, limit access for users who can create pods and monitor pod activity closely.