Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN554
_____________________________________________________________________

DATE                : 28/08/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running kube-apiserver versions prior to
                             1.31.12, 1.32.8, 1.33.4.

=====================================================================
https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE
_____________________________________________________________________

[Security Advisory] CVE-2025-5187: Nodes can delete themselves by
adding an OwnerReference

Nathan Herz

14 août 2025, 03:56:56


Hello Kubernetes Community,

A vulnerability exists in the NodeRestriction admission controller
where node users can delete their corresponding node object by
patching themselves with an OwnerReference to a cluster-scoped
resource. If the OwnerReference resource does not exist or is
subsequently deleted, the given node object will be deleted via
garbage collection. By default, node users are authorized for
create and patch requests but not delete requests against their
node object. Since the NodeRestriction admission controller
does not prevent patching OwnerReferences, a compromised node
could leverage this vulnerability to delete and then recreate
its node object with modified taints or labels.

This issue has been rated Medium
(6.7) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L, and
assigned CVE-2025-5187.


Am I vulnerable?

All clusters that have enabled the NodeRestriction but not the
OwnerReferencesPermissionEnforcement admission controller are
vulnerable. The OwnerReferencesPermissionEnforcement
controller protects access to the OwnerReferences of an object
so that only users with delete permission to the object can
change it.


Affected Versions

    kube-apiserver: <= v1.31.11

    kube-apiserver: <= v1.32.7

    kube-apiserver: <= v1.33.3


How do I mitigate this vulnerability?

This issue can be mitigated by upgrading to a kube-apiserver
binary running one of patched versions for 1.31 through 1.33
listed below. These fixed versions have added functionality to
the NodeRestriction admission controller to prevent node users
from modifying their own OwnerReferences. 

Alternatively, this vulnerability can be mitigated by enabling
the OwnerReferencesPermissionEnforcement admission controller,
which will prevent any user without delete permissions on an
object from modifying the OwnerReferences on that object.
Note that this admission controller will apply to all users
and object types.


Fixed Versions

    kube-apiserver: >= v1.31.12

    kube-apiserver: >= v1.32.8

    kube-apiserver: >= v1.33.4


Detection

	
This issue can be detected on clusters which have
NodeRestriction but not OwnerReferencesPermissionEnforcement
enabled by analyzing API audit logs for node patch requests
issued by node users which modify OwnerReferences. In
normal operation, a Kubelet will never issue a patch
request which modifies its own OwnerReferences.

If you find evidence that this vulnerability has been
exploited, please contact secu...@kubernetes.io


Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/133471


Acknowledgements

This vulnerability was reported by Paul Viossat.

The issue was fixed and coordinated by: 

    Sergey Kanzhelev @SergeyKanzhelev
    Jordan Liggitt @liggitt
    Marko Mudrinić @xmudrii


Thank You,

Nathan Herz on behalf of the Kubernetes Security Response
Committee


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================