PT-2020-9759 · Canonical · Microk8S

Denis Andzakovic · Published 2020-04-08 · Updated 2020-10-16 · CVE-2019-15789

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MicroK8s versions prior to 1.15.3

Description A privilege escalation issue allows a low-privilege user with local access to obtain root access to the host by provisioning a privileged container.

Recommendations For versions prior to 1.15.3, update to MicroK8s 1.15.3 to resolve the issue. As a temporary workaround, consider restricting local access to prevent low-privilege users from provisioning privileged containers.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2019-15789

Affected Products

Microk8S

References · 7

• 🔥 https://pulsesecurity.co.nz/advisories/microk8s-privilege-escalation · Exploit
• https://osv.dev/vulnerability/CVE-2019-15789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15789 · Security Note
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15789.html · Vendor Advisory
• https://github.com/ubuntu/microk8s/pull/590 · Note
• https://t.me/cvenotify/2524 · Telegram Post
• https://discuss.kubernetes.io/t/explicit-use-of-sudo-in-microk8s-cli/7605 · Note