PT-2023-16097 · Red Hat · Openshift

Sam Fowler · Published 2023-01-25 · Updated 2023-02-16 · CVE-2023-0229

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenShift versions 4.11 through 4.12

Description A flaw was found in the apiserver-library-go package that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." The seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default" by default, which allows users to disable seccomp for pods they can create and modify.

Recommendations For OpenShift versions 4.11 and 4.12, consider restricting the ability of low-privileged users to set the seccomp profile for pods they control to prevent potential exploitation. As a temporary workaround, consider disabling the use of the "unconfined" seccomp profile for pods until a patch is available. Restrict access to the restricted-v2 Security Context Constraint (SCC) to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-0229

GHSA-5465-XC2J-6P84

GO-2023-1549

RHSA-2023:1325

Affected Products

Openshift

References · 8

• https://bugzilla.redhat.com/show_bug.cgi?id=2160349 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0229 · Security Note
• https://osv.dev/vulnerability/GHSA-5465-xc2j-6p84 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0229 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1549 · Vendor Advisory
• https://github.com/openshift/apiserver-library-go/commit/30f75d79e424ca462c6de53ee8b93f91183763e6 · Note
• https://github.com/openshift/apiserver-library-go/pull/97 · Note
• https://github.com/advisories/GHSA-5465-xc2j-6p84 · Note