Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN145

_____________________________________________________________________

DATE                : 14/03/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Kubernetes.

=====================================================================
https://groups.google.com/g/kubernetes-security-announce
_____________________________________________________________________

CVE-2025-1767 GitRepo Volume Inadvertent Local Repository Access

Photo du profil de Vellore Rajakumar, Sri Saran Balaji
Vellore Rajakumar, Sri Saran Balaji

13 mars 2025, 17:12:19 
à kubernete...@googlegroups.com,d...@kubernetes.io,kubernetes-sec...
@googlegroups.com,kubernetes-se...@googlegroups.com,distributo...
@kubernetes.io


Issue Details

A security vulnerability was discovered in Kubernetes that could allow
a user with create pod permission to exploit gitRepo volumes to access
local git repositories belonging to other pods on the same node.

This issue has been rated Medium
(CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) (score: 6.5), and
assigned CVE-2025-1767.


Am I vulnerable?

This CVE only affects Kubernetes clusters that utilize the in-tree
gitRepo volume to clone git repositories from other pods within the
same node. Since the in-tree gitRepo volume feature has been deprecated
and will not receive security updates upstream, any cluster still using
this feature remains vulnerable. 


Affected Components

    kubelet

 

Affected Versions

    All versions of Kubernetes

How do I mitigate this vulnerability?

 
To mitigate this vulnerability, you must use an init container to
perform git clone operation and then mount the directory into the
Pod's container. An example of this approach is provided here.

Note: You can also restrict the use of gitRepo volumes in your
cluster using policies such as ValidatingAdmissionPolicy or through
Restricted pod security standard policy. You can use the following
Common Expression Language (CEL) expression as part of a policy to
reject use of
gitRepo volumes: `has(object.spec.volumes) || !object.spec.volumes.exists(v, has(v.gitRepo))`


Detection
To detect whether this vulnerability has been exploited, you can
use the following command to list all pods that use the in-tree
gitRepo volume and clones to a .git subdirectory. 

`kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.volumes[].gitRepo.repository | test("^/")) | {name: .metadata.name, namespace: .metadata.namespace, repository: (.spec.volumes[] | select(.gitRepo) | .gitRepo.repository)}'`


If you find evidence that this vulnerability has been exploited,
please contact secu...@kubernetes.io 

 
Additional Details
See Kubernetes Issue #130786 for more details.
 

Acknowledgements
This vulnerability was reported by Christophe Hauquiert.

Thank You,

Balaji on behalf of the Kubernetes Security Response Committee


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================