Impact
The KubeEdge NodeUpgradeJob handler constructed the keadm upgrade edge command by concatenating the user-controlled spec.version and spec.image fields into a shell command.
An authenticated user with permission to create or update NodeUpgradeJob resources through the v1alpha2 API could include shell metacharacters in either field. When the upgrade job was processed, the injected command could be executed on the targeted edge node with the privileges available to the upgrade process.
Successful exploitation could result in arbitrary command execution and compromise the confidentiality, integrity, and availability of the affected edge node.
Patches
The fix removes shell-based command construction and invokes keadm using a structured argument list through exec.Command.
The version and image values are passed as separate literal arguments and are no longer interpreted by a command shell.
The fixed versions:
KubeEdge v1.23.1 KubeEdge v1.22.2 KubeEdge v1.21.2
Workarounds
Until a patched version is available:
restrict permission to create or update NodeUpgradeJob resources to trusted administrators; do not allow untrusted users or tenants to control the spec.version or spec.image fields; avoid using NodeUpgradeJob-based edge upgrades in environments where these fields may be influenced by untrusted users.
Credits
KubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.
Summary
KubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads a 32-bit payload length from the message header and previously allocated a buffer of that size without enforcing an upper bound.
An authenticated peer that can establish a viaduct connection to CloudHub can send a crafted message header containing an excessively large payload length. This may cause CloudHub to allocate a large amount of memory and can result in memory exhaustion, process termination, or denial of service.
Impact
A successfully authenticated malicious or compromised edge node may repeatedly send crafted viaduct message headers to increase CloudHub memory consumption.
Depending on available memory and deployment limits, exploitation may cause:
Increased CloudHub memory usage Out-of-memory termination CloudHub restart loops Temporary disruption of cloud-edge communication
Authentication to the viaduct endpoint is required. This issue does not provide unauthenticated access or direct code execution.
Root cause
The viaduct packer trusted the payload length encoded in the message header and allocated the payload buffer before validating whether the declared length was within an acceptable range.
Fix
The fix introduces a maximum viaduct payload size of 32 MiB.
The updated implementation:
Rejects oversized payload lengths in the reader before memory allocation Enforces the same maximum size in the writer Adds regression tests covering oversized and valid payloads
Fixes have been prepared for the following patch releases:
KubeEdge v1.23.1 KubeEdge v1.22.2 KubeEdge v1.21.2
These versions should not be listed as released until the coordinated release process is complete.
Workarounds
Before patched versions are available, operators should:
Restrict access to the CloudHub endpoint to trusted edge nodes and networks Protect and rotate edge-node credentials Revoke credentials belonging to decommissioned or potentially compromised nodes Apply memory limits and restart policies to the CloudHub workload Monitor CloudHub memory consumption and unexpected connection activity
Affected component
pkg/viaduct/pkg/packer CloudHub viaduct message-processing path
Credits
KubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.
Description
KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function.
Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths could cause files to be written outside the intended extraction directory.
The issue is particularly relevant to Windows edge nodes during the keadm join or installation process when keadm extracts downloaded component archives.
Impact
An attacker who can cause an affected keadm process to extract a malicious archive may write or overwrite files outside the intended destination directory with the privileges of the user running keadm.
On Windows edge nodes, this may allow modification of configuration files, executable files, service-related files, or other writable system locations. Depending on the overwritten file and the privileges of the keadm process, successful exploitation could lead to persistent system modification or code execution.
Exploitation requires the attacker to influence the contents of an archive processed by keadm, such as through a compromised, replaced, or otherwise untrusted download source.
Patches
The extraction logic now:
resolves the destination directory to an absolute path; rejects empty archive entry names; normalizes Windows-style path separators before validation; rejects parent-directory traversal paths; rejects absolute and Windows drive-prefixed paths; uses filepath-securejoin to ensure extracted files remain within the destination directory.
Fixes are planned for the following maintained releases:
v1.23.1 v1.22.2 v1.21.2
Workarounds
Until a patched release is available:
only install or join edge nodes using trusted KubeEdge package sources; verify the integrity and origin of downloaded archives before extraction; do not use custom or untrusted component archives with keadm; restrict write permissions and administrative privileges for the account running keadm; avoid performing Windows edge-node installation or join operations when the package source cannot be trusted.
Credits
KubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.
Description
KubeEdge ConfigUpdateJob processing was vulnerable to command injection on edge nodes.
The updateFields values from a ConfigUpdateJob were concatenated into a command string and executed through a system shell. An authenticated user with sufficient permissions to create or update ConfigUpdateJob resources could include shell metacharacters in the supplied configuration fields and cause unintended commands to be executed on targeted edge nodes.
Impact
Successful exploitation could allow an authenticated attacker to execute arbitrary commands on affected edge nodes with the privileges of the KubeEdge process handling the ConfigUpdateJob.
The attacker must already have permission to create or modify ConfigUpdateJob resources and target an enrolled edge node.
Patches
The fix removes shell-based command construction and invokes keadm config-update using structured command arguments.
The complete --set value is passed as a single literal argument, preventing shell metacharacters from being interpreted as commands.
Fixes are planned for the following maintained releases:
v1.23.1 v1.22.2 v1.21.2
Workarounds
Until a patched release is available:
restrict RBAC permissions for creating or modifying ConfigUpdateJob resources; allow only trusted administrators to submit configuration update jobs; avoid using ConfigUpdateJob in environments where its input cannot be fully trusted; monitor ConfigUpdateJob resources and edge-node process activity for unexpected commands or changes.
Credits
KubeEdge thanks Sang-Hoon Choi (KoreaSecurity, Sejong University) for responsibly reporting this issue and for coordinating with the KubeEdge maintainers through the security disclosure process.