PT-2020-20213 · Kubernetes · Kubernetes Csi Snapshot-Controller

Qin Ping · Published 2020-12-15 · Updated 2022-02-15 · CVE-2020-8569

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kubernetes CSI snapshot-controller versions prior to 2.1.3 and 3.0.2

Description The issue occurs when the Kubernetes CSI snapshot-controller processes a VolumeSnapshot custom resource under specific conditions: the VolumeSnapshot references a non-existing PersistentVolumeClaim and does not reference any VolumeSnapshotClass. This causes the snapshot-controller to crash and, upon automatic restart by Kubernetes, enter an endless crash loop when processing the same VolumeSnapshot custom resource again. The vulnerability affects only the volume snapshot feature, preventing users from taking snapshots of their volumes or deleting existing snapshots. All other Kubernetes functionality remains unaffected.

Recommendations For versions prior to 2.1.3, update to version 2.1.3 or later. For versions prior to 3.0.2, update to version 3.0.2 or later. As a temporary workaround, consider disabling the volume snapshot feature until a patch is available. Restrict access to the VolumeSnapshot custom resource to minimize the risk of exploitation.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-8569

GHSA-HWRR-RHMM-VCVF

Affected Products

Kubernetes Csi Snapshot-Controller

References · 8

• 🔥 https://github.com/kubernetes-csi/external-snapshotter/issues/380 · Exploit
• https://osv.dev/vulnerability/CVE-2020-8569 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hwrr-rhmm-vcvf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8569 · Security Note
• https://t.me/cibsecurity/22503 · Telegram Post
• https://t.me/k8security/166 · Telegram Post
• https://groups.google.com/g/kubernetes-security-announce/c/1EzCr1qUxxU · Note
• https://t.me/k8security/223 · Telegram Post