PT-2022-20511 · Kubeedge · Kubeedge

Adam Korczynski + 1 · Published 2022-06-25 · Updated 2024-08-21 · CVE-2022-31076

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions KubeEdge versions prior to 1.11.0 KubeEdge versions prior to 1.10.1 KubeEdge versions prior to 1.9.3

Description A malicious message can crash CloudCore by triggering a nil-pointer dereference in the UDS Server. The attack is limited to the local host network and requires an attacker to be an authenticated user of the Cloud. This issue only affects users who have turned on the unixsocket switch in the config file cloudcore.yaml.

Recommendations For versions prior to 1.11.0, update to version 1.11.0 to resolve the issue. For versions prior to 1.10.1, update to version 1.10.1 to resolve the issue. For versions prior to 1.9.3, update to version 1.9.3 to resolve the issue. As a temporary workaround, consider disabling the unixsocket switch of CloudHub in the config file cloudcore.yaml.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2022-31076

GHSA-8F4F-V9X5-CG6J

GO-2022-0500

Affected Products

Kubeedge

References · 10

• 🔥 https://github.com/kubeedge/kubeedge/security/advisories/GHSA-8f4f-v9x5-cg6j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31076.json · Exploit
• https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe8137664701 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31076 · Security Note
• https://osv.dev/vulnerability/GO-2022-0500 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8f4f-v9x5-cg6j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31076 · Vendor Advisory
• https://github.com/kubeedge/kubeedge · Note
• https://t.me/cibsecurity/45231 · Telegram Post
• https://t.me/cvenotify/32253 · Telegram Post