https://seclists.org/oss-sec/2025/q2/259: [kubernetes] Race Condition in Go allows Volume Deletion in older Kubernetes versions
Published Jun 17, 2025
·Updated
Affected Software
2 affected components
Kubernetes kubernetes<1.30.2, <1.29.6, <1.28.11, <1.27.15
go Go<1.21.11, <1.22.4
Frequently Asked Questions
1
What is the severity of vulnerability K8S-2025-001?
The severity of vulnerability K8S-2025-001 is considered high due to its potential to allow unauthorized deletion of directories in older Kubernetes versions.
2
How do I fix vulnerability K8S-2025-001?
To fix vulnerability K8S-2025-001, you should upgrade to Go versions 1.21.11 or 1.22.4 and update your Kubernetes deployment accordingly.
3
Which versions of Kubernetes are affected by K8S-2025-001?
Kubernetes versions that use the affected Go versions prior to the fixes in 1.21.11 and 1.22.4 are vulnerable to K8S-2025-001.
4
What types of attacks are possible with K8S-2025-001?
Exploitation of K8S-2025-001 could allow an attacker to delete arbitrary directories, potentially leading to service disruption.
5
How can I mitigate the risks associated with K8S-2025-001?
To mitigate the risks of K8S-2025-001, ensure that your Kubernetes environments are updated to the latest stable releases post-fix.