[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] [kubernetes] CVE-2021-25740: Endpoint & EndpointSlice permissions allow cross-Namespa
From: CJ Cullen <cjcullen () google ! com>
Date: 2021-07-14 21:27:43
Message-ID: CABdrxGDe8UB=+AcQUVk87ExyEMmE3MJQ16ON7aGTuRORnbK9iw () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
Hello Kubernetes Community,
A security issue was discovered with Kubernetes that could enable users to
send network traffic to locations they would otherwise not have access to
via a confused deputy attack.
This issue has been rated Low severity (
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N>),
and assigned CVE-2021-25740.
Am I vulnerable?
If a potential attacker can create or edit Endpoints or EndpointSlices in
the Kubernetes API, they can potentially direct a LoadBalancer or Ingress
implementation to expose backend IPs the attacker should not have access to.
Importantly, if the target's NetworkPolicy already trusts the Load Balancer
or Ingress implementation, NetworkPolicy can not be used to prevent
exposure from other namespaces, potentially bypassing any security controls
such as LoadBalancerSourceRanges.
This issue is a design flaw that cannot be fully mitigated without
user-facing changes. With this public announcement, we can begin
conversations about a long-term fix.
Affected Versions
All Kubernetes versions are affected.
How do I mitigate this vulnerability?
There is no patch for this issue, and it can currently only be mitigated by
restricting access to the vulnerable features. To mitigate the exposure, we
recommend restricting write access to Endpoints and EndpointSlices by
updating the system:aggregate-to-edit role using the attached file. This
will remove write access to Endpoints from the admin and edit roles:
# Allow kubectl auth reconcile to work
kubectl annotate --overwrite clusterrole/system:aggregate-to-edit
rbac.authorization.kubernetes.io/autoupdate=true
# Test reconcile, then run for real if happy
kubectl auth reconcile --remove-extra-permissions -f aggregate_to_edit.yaml
--dry-run
kubectl auth reconcile --remove-extra-permissions -f aggregate_to_edit.yaml
# Prevent autoreconciliation back to old state
kubectl annotate --overwrite clusterrole/system:aggregate-to-edit
rbac.authorization.kubernetes.io/autoupdate=false
Note: This will prevent new versions of Kubernetes from reconciling new
default permissions to this role. No new default permissions have been
added to this role since v1.14.0, but we recommend you remove the
autoupdate=false
annotation as soon as a fix or other mitigation is possible.
For use-cases that need to edit these resources, we recommend creating a
new purpose-built Role with the desired permissions, and using it only for
those cases.
Detection
Services with an empty selector rely on custom endpoints and are vulnerable
to the attack described above. We recommend manually auditing any such
usage. The following kubectl command will list all Services in a cluster
with their selector:
kubectl get svc --all-namespaces -o=custom-columns='NAME:metadata.name
,NAMESPACE:metadata.namespace,SELECTOR:spec.selector'
Note: Some Services without selectors specified may have their Endpoints
managed by other controllers or tools. For example, endpoints for the
default/kubernetes Service are managed by the Kubernetes API Server.
If you find evidence that this vulnerability has been exploited, please
contact security@kubernetes.io
Additional Advisory
A similar attack is possible using Ingress implementations that support
forwarding to ExternalName Services. This can be used to forward to
Services in other namespaces or, in some cases, sensitive endpoints within
the Ingress implementation. If you are using the Ingress API, we recommend
confirming that the implementation you're using either does not support
forwarding to ExternalName Services or supports disabling the functionality.
Additional Details
See the GitHub issue for more updates:
https://github.com/kubernetes/kubernetes/issues/103675
Thank You,
Rob Scott on behalf of Kubernetes SIG Network and CJ Cullen on behalf of
the Kubernetes Product Security Committee
[Attachment #5 (text/html)]
<div dir="ltr"><div class="gmail_quote"><div dir="ltr"><span \
id="m_-174318033722803972gmail-docs-internal-guid-15c3dab8-7fff-d5de-7753-53680c2a23c2"><p \
dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Hello \
Kubernetes Community,</span></p><br><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">A \
security issue was discovered with Kubernetes that could enable users to send network traffic \
to locations they would otherwise not have access to via a confused deputy attack. \
</span></p><br><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">This \
issue has been rated </span><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-weigh \
t:700;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Low</span><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"> \
severity (</span><a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" \
style="text-decoration-line:none" target="_blank"><span \
style="font-size:12pt;font-family:Arial;background-color:transparent;font-variant-numeric:normal \
;font-variant-east-asian:normal;text-decoration-line:underline;vertical-align:baseline;white-space:pre-wrap">CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N</span></a><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">), \
and assigned </span><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-weigh \
t:700;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">CVE-2021-25740</span><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">.</span></p><h3 \
dir="ltr" style="line-height:1.2;margin-top:18pt;margin-bottom:12pt"><span \
style="font-size:16.5pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font- \
variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Am \
I vulnerable?</span></h3><p dir="ltr" \
style="line-height:1.38;margin-top:3pt;margin-bottom:0pt;padding:0pt 0pt 12pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font-va \
riant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">If \
a potential attacker can create or edit Endpoints or EndpointSlices in the Kubernetes API, they \
can potentially direct a LoadBalancer or Ingress implementation to expose backend IPs the \
attacker should not have access to.</span></p><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font-va \
riant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Importantly, \
if the target's NetworkPolicy already trusts the Load Balancer or Ingress implementation, \
NetworkPolicy can not be used to prevent exposure from other namespaces, potentially bypassing \
any security controls such as LoadBalancerSourceRanges.</span></p><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:12pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font-va \
riant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">This \
issue is a design flaw that cannot be fully mitigated without user-facing changes. With this \
public announcement, we can begin conversations about a long-term fix.</span></p><h4 dir="ltr" \
style="line-height:1.2;margin-top:18pt;margin-bottom:12pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font-va \
riant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Affected \
Versions</span></h4><p dir="ltr" \
style="line-height:1.2;margin-top:18pt;margin-bottom:12pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">All \
Kubernetes versions are affected. </span></p><h3 dir="ltr" \
style="line-height:1.2;margin-top:18pt;margin-bottom:12pt"><span \
style="font-size:16.5pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font- \
variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">How \
do I mitigate this vulnerability?</span></h3><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">There \
is no patch for this issue, and it can currently only be mitigated by restricting access to the \
vulnerable features. To mitigate the exposure, we recommend restricting write access to \
Endpoints and EndpointSlices by updating the system:aggregate-to-edit role using the attached \
file. This will remove write access to Endpoints from the admin and edit \
roles:</span></p><br><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal; \
font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"><font \
face="monospace"># Allow kubectl auth reconcile to work</font></span></p><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal; \
font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"><font \
face="monospace">kubectl annotate --overwrite clusterrole/system:aggregate-to-edit <a \
href="http://rbac.authorization.kubernetes.io/autoupdate=true" \
target="_blank">rbac.authorization.kubernetes.io/autoupdate=true</a></font></span></p><font \
face="monospace"><br></font><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal; \
font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"><font \
face="monospace"># Test reconcile, then run for real if happy</font></span></p><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal; \
font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"><font \
face="monospace">kubectl auth reconcile --remove-extra-permissions -f aggregate_to_edit.yaml \
--dry-run</font></span></p><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal; \
font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"><font \
face="monospace">kubectl auth reconcile --remove-extra-permissions -f \
aggregate_to_edit.yaml</font></span></p><font face="monospace"><br></font><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal; \
font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"><font \
face="monospace"># Prevent autoreconciliation back to old state</font></span></p><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal; \
font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"><font \
face="monospace">kubectl annotate --overwrite clusterrole/system:aggregate-to-edit <a \
href="http://rbac.authorization.kubernetes.io/autoupdate=false" \
target="_blank">rbac.authorization.kubernetes.io/autoupdate=false</a></font></span></p><br><p \
dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-weigh \
t:700;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Note:</span><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"> \
This will prevent new versions of Kubernetes from reconciling new default permissions to this \
role. No new default permissions have been added to this role since v1.14.0, but we recommend \
you remove the </span><span \
style="font-size:12pt;font-family:Consolas,sans-serif;color:rgb(0,0,0);background-color:transpar \
ent;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">autoupdate=false \
</span><span style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transpare \
nt;font-variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">annotation \
as soon as a fix or other mitigation is possible.</span></p><br><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">For \
use-cases that need to edit these resources, we recommend creating a new purpose-built Role \
with the desired permissions, and using it only for those cases.</span></p><h3 dir="ltr" \
style="line-height:1.2;margin-top:18pt;margin-bottom:12pt"><span \
style="font-size:16.5pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font- \
variant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Detection</span></h3><p \
dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Services \
with an empty selector rely on custom endpoints and are vulnerable to the attack described \
above. We recommend manually auditing any such usage. The following kubectl command will list \
all Services in a cluster with their selector:</span></p><br><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal; \
font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"><font \
face="monospace">kubectl get svc --all-namespaces -o=custom-columns='NAME:<a \
href="http://metadata.name" \
target="_blank">metadata.name</a>,NAMESPACE:metadata.namespace,SELECTOR:spec.selector'</font></span></p><br><p \
dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Note: \
Some Services without selectors specified may have their Endpoints managed by other controllers \
or tools. For example, endpoints for the default/kubernetes Service are managed by the \
Kubernetes API Server. </span></p><br><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">If \
you find evidence that this vulnerability has been exploited, please contact </span><a \
href="mailto:security@kubernetes.io" style="text-decoration-line:none" target="_blank"><span \
style="font-size:12pt;font-family:Arial;background-color:transparent;font-variant-numeric:normal \
;font-variant-east-asian:normal;text-decoration-line:underline;vertical-align:baseline;white-space:pre-wrap">security@kubernetes.io</span></a><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"> \
</span></p><h4 dir="ltr" style="line-height:1.2;margin-top:18pt;margin-bottom:12pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font-va \
riant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Additional \
Advisory</span></h4><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">A \
similar attack is possible using Ingress implementations that support forwarding to \
ExternalName Services. This can be used to forward to Services in other namespaces or, in some \
cases, sensitive endpoints within the Ingress implementation. If you are using the Ingress API, \
we recommend confirming that the implementation you're using either does not support forwarding \
to ExternalName Services or supports disabling the functionality.</span></p><h4 dir="ltr" \
style="line-height:1.2;margin-top:18pt;margin-bottom:12pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font-va \
riant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Additional \
Details</span></h4><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">See \
the GitHub issue for more updates: </span><a \
href="https://github.com/kubernetes/kubernetes/issues/103675" style="text-decoration-line:none" \
target="_blank"><span \
style="font-size:12pt;font-family:Arial;background-color:transparent;font-variant-numeric:normal \
;font-variant-east-asian:normal;text-decoration-line:underline;vertical-align:baseline;white-spa \
ce:pre-wrap">https://github.com/kubernetes/kubernetes/issues/103675</span></a><span \
style="font-size:12pt;font-family:Arial;color:rgb(0,0,0);background-color:transparent;font-varia \
nt-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap"> \
</span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;padding:0pt \
0pt 12pt"> </p><p dir="ltr" \
style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;padding:0pt 0pt 12pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font-va \
riant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Thank \
You,</span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span \
style="font-size:12pt;font-family:Arial;color:rgb(36,41,46);background-color:transparent;font-va \
riant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline;white-space:pre-wrap">Rob \
Scott on behalf of Kubernetes SIG Network and CJ Cullen on behalf of the Kubernetes Product \
Security Committee</span></p></span><br></div> </div></div>
--00000000000004cea805c71c0755--
["aggregate_to_edit.yaml" (application/x-yaml)]
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic