====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN396
_____________________________________________________________________

DATE                : 16/07/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running kube-apiserver versions prior to
                                1.18.6, 1.17.9, 1.16.13.

=====================================================================
https://groups.google.com/forum/#!topic/kubernetes-announce/44da1m3evoU
_____________________________________________________________________

[Security Advisory] CVE-2020-8559: Privilege escalation from compromised
node to cluster


Hello Kubernetes Community,

A security issue was discovered in the kube-apiserver that could enable
a privilege escalation from a compromised node.

This issue has been rated Medium
(CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H), and assigned CVE-2020-8559.

If an attacker is able to intercept certain requests to the Kubelet,
they can send a redirect response that may be followed by a client using
the credentials from the original request. This can lead to compromise
of other nodes.

If multiple clusters share the same certificate authority trusted by the
client, and the same authentication credentials, this vulnerability may
allow an attacker to redirect the client to another cluster. In this
configuration, this vulnerability should be considered High severity.


Am I vulnerable?

You are only affected by this vulnerability if you treat the node as a
security boundary, or if clusters share certificate authorities and
authentication credentials.

Note that this vulnerability requires an attacker to first compromise a
node through separate means.


Affected Versions

    kube-apiserver v1.18.0-1.18.5

    kube-apiserver v1.17.0-1.17.8

    kube-apiserver v1.16.0-1.16.12

    all kube-apiserver versions prior to v1.16.0

How do I mitigate this vulnerability?

To mitigate this vulnerability you must upgrade the kube-apiserver to a
patched version.


Fixed Versions

    kube-apiserver v1.18.6

    kube-apiserver v1.17.9

    kube-apiserver v1.16.13

Fix impact: Proxied backends (such as an extension API server) that
respond to upgrade requests with a non-101 response code may be broken
by this patch.

To upgrade, refer to the documentation:
https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster


Detection

Upgrade requests should never respond with a redirect. If any of the
following requests have a response code in the 300-399 range, it may be
evidence of exploitation. This information can be found in the
Kubernetes audit logs.

    pods/exec

    pods/attach

    pods/portforward

    any resource: proxy

If you find evidence that this vulnerability has been exploited, please
contact secu...@kubernetes.io


Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/92914


Acknowledgements

This vulnerability was reported by Wouter ter Maat of Offensi, via the
Kubernetes bug bounty.

Thank You,

Tim Allclair on behalf of the Kubernetes Product Security Committee


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================