PT-2018-5276 · Linux Foundation+1 · Kubernetes+1

Maxim Ivanov

·

Published

2018-03-13

·

Updated

2022-03-04

·

CVE-2017-1002101

CVSS v3.1

9.6

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Kubernetes versions 1.3.x through 1.6.x Kubernetes versions 1.7.x through 1.7.13 Kubernetes versions 1.8.x through 1.8.8 Kubernetes versions 1.9.x through 1.9.3
Description The issue allows containers using subpath volume mounts to access files and directories outside of the volume, including the host's filesystem, due to a flaw in Kubernetes. This affects containers with any volume type, including non-privileged pods, subject to file permissions.
Recommendations For Kubernetes versions 1.3.x through 1.6.x, update to version 1.7.14 or later. For Kubernetes versions 1.7.x through 1.7.13, update to version 1.7.14 or later. For Kubernetes versions 1.8.x through 1.8.8, update to version 1.8.9 or later. For Kubernetes versions 1.9.x through 1.9.3, update to version 1.9.4 or later.

Exploit

Fix

Link Following

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2017-1002101
OPENSUSE-SU-2020:0554-1
OPENSUSE-SU-2020_0554-1
OPENSUSE-SU-2024:10901-1
RHSA-2018:0475

Affected Products

Kubernetes
Suse