PT-2023-6920 · Unknown+2 · Kubernetes+2

Tomer Peled + 1 · Published 2023-11-14 · Updated 2025-08-08 · CVE-2023-5528

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to 1.28.4 Kubernetes versions prior to 1.27.8 Kubernetes versions prior to 1.26.11 Kubernetes versions prior to 1.25.16

Description A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. The vulnerability is related to insufficient input validation in the in-tree storage plugin for Windows nodes, which can lead to remote code execution with SYSTEM privileges on Windows endpoints. This issue affects Kubernetes clusters that use an in-tree storage plugin for Windows nodes.

Recommendations For Kubernetes versions prior to 1.28.4, update to version 1.28.4 or later. For Kubernetes versions prior to 1.27.8, update to version 1.27.8 or later. For Kubernetes versions prior to 1.26.11, update to version 1.26.11 or later. For Kubernetes versions prior to 1.25.16, update to version 1.25.16 or later. As a temporary workaround, consider restricting access to the in-tree storage plugin for Windows nodes until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2023-7744

ALT-PU-2023-7745

ALT-PU-2023-8073

ALT-PU-2023-8074

ALT-PU-2024-8233

ALT-PU-2024-8235

AZL-32005

AZL-34894

BDU:2023-07938

CVE-2023-5528

ECHO-B1E8-A7C2-283A

GHSA-HQ6Q-C2X6-HMCH

GO-2023-2341

OPENSUSE-SU-2025:15424-1

ROSA-SA-2024-2548

Affected Products

Alt Linux

Kubernetes

Red Os

References · 121

• https://github.com/kubernetes/kubernetes/issues/121879 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4 · Patch
• https://osv.dev/vulnerability/GO-2023-2341 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15424-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07938 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7 · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ · Patch
• https://osv.dev/vulnerability/AZL-34894 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hq6q-c2x6-hmch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5528 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/705949 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5528 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-32005 · Vendor Advisory
• https://github.com/kubernetes/kubernetes · Note
• https://github.com/kubernetes/kubernetes/pull/121882 · Note