REDHAT-BUG-2215555: Low severity Kubernetes Kubelet vulnerability
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
References: https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10 https://github.com/kubernetes/kubernetes/issues/118690
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2215555?
The severity of REDHAT-BUG-2215555 is considered critical due to the potential for pods to bypass seccomp profile enforcement.
How do I fix REDHAT-BUG-2215555?
To fix REDHAT-BUG-2215555, update your Kubernetes Kubelet to a patched version that properly enforces seccomp profiles.
Which versions of Kubelet are affected by REDHAT-BUG-2215555?
All versions of Kubernetes Kubelet that allow pods to specify an empty seccomp profile field are affected by REDHAT-BUG-2215555.
What does REDHAT-BUG-2215555 allow attackers to do?
REDHAT-BUG-2215555 allows attackers to run pods in an unconfined security context, potentially exposing the host to security risks.
Is there a workaround for REDHAT-BUG-2215555?
A temporary workaround for REDHAT-BUG-2215555 is to avoid using empty seccomp profile fields in your pod specifications.