PT-2022-15051 · Istio · Istio

Howardjohn · Published 2022-01-19 · Updated 2022-02-08 · CVE-2022-21701

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Istio versions 1.12.0 through 1.12.1

Description Istio is an open platform to connect, manage, and secure microservices. The issue allows users with CREATE permission for gateways.gateway.networking.k8s.io objects to escalate this privilege and create other resources they may not have access to, such as Pod. This impacts only the Alpha level feature, the Kubernetes Gateway API, and not the Istio Gateway type.

Recommendations For versions 1.12.0 and 1.12.1, upgrade to a newer version to resolve the issue. As a temporary workaround for versions 1.12.0 and 1.12.1, consider one of the following: remove the gateways.gateway.networking.k8s.io CustomResourceDefinition, set the PILOT ENABLE GATEWAY API DEPLOYMENT CONTROLLER=true environment variable in Istiod, or remove CREATE permissions for gateways.gateway.networking.k8s.io objects from untrusted users.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-21701

GHSA-MQ8F-9446-C28R

Affected Products

Istio

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21701.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-21701 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21701 · Vendor Advisory
• https://istio.io/latest/news/releases/1.12.x/announcing-1.12.2 · Vendor Advisory
• https://github.com/istio/istio/security/advisories/GHSA-mq8f-9446-c28r · Note
• https://t.me/cibsecurity/35904 · Telegram Post
• https://t.me/k8security/504 · Telegram Post