=====================================================================

                               CERT-Renater

                    Note d'Information No. 2023/VULN231

_____________________________________________________________________

DATE                : 23/06/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running kOps versions prior to 1.26.2,
                                           1.25.4.

=====================================================================
https://groups.google.com/g/kubernetes-security-announce/c/yrCE1x89oaU
_____________________________________________________________________


[kOps Security Advisory] CVE-2023-1943: Privilege Escalation in kOps
using GCE/GCP Provider in Gossip Mode


A security issue was reported in kOps with the GCP Provider running
in Gossip Mode, where Node service account credentials could be used
by a container running in the cluster to retrieve sensitive
information from the state storage bucket and escalate to
cluster-admin permissions.

This issue has been rated High
(CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and assigned
CVE-2023-1943.


Affected Components and Configurations

This bug affects the kOps GCP provider, only when running in Gossip
Mode. See below for information about other providers.


Affected Versions

     v1.26.0 - v1.26.1

     <v1.25.4


Fixed Versions

     v1.26.2

     V1.25.4


Recent kOps improvements have systematically reduced the potential
for this class of attacks, by reducing or eliminating cloud
credentials/privileges on the nodes.  The recommended versions
vary by cloud:

AWS users: should not be affected in recent versions.  kOps
version 1.26 (or later) is recommended, but not a critical update.

GCE users: recommended kOps version is 1.26.3 (or later).

DigitalOcean users: recommended kOps version is 1.27.0-alpha.2 (or
later), with `--dns=none` for new clusters.  Cloud credentials
have been removed from the nodes in this configuration.  Future
versions will likely make dns=none the default.

Hetzner users: recommended kOps version is 1.27.0-alpha.2 (or
later).  Cloud credentials have been removed from the nodes in
this configuration.

(Azure, Scaleway and other cloud providers are following the
same approach, but as these are in alpha we recommend using
the latest kOps version, and generally do not recommend
production usage when in alpha).


Detection

If you find evidence that this vulnerability has been
exploited, please contact secu...@kubernetes.io


Additional Details

See kOps Issue #15539 for more details.


Acknowledgements

This vulnerability was reported by James Cleverley-Prance

Thank You,

CJ Cullen on behalf of the Kubernetes Security Response Committee


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================