Bug 1850380 (CVE-2020-14306)

Summary:	CVE-2020-14306 openshift-service-mesh/istio-rhel8-operator: control plane can deploy gateway image to any namespace
Product:	[Other] Security Response	Reporter:	Mark Cooper <mcooper>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	kconner, rcernich, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	servicemesh-operator-1.1.4-3	Doc Type:	If docs needed, set a value
Doc Text:	An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-01 19:28:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1850371

Description Mark Cooper 2020-06-24 07:49:25 UTC

In all versions of servicemesh-operator through 1.1.3, when deploying the Service Mesh control plane the operator will deploy the ingress gateway to any namespace regardless of the current user's permissions. Additionally the image deployed as the gateway can also be specified by a user. An attacker with basic cluster permissions can exploit this to deploy their own pod into a namespace owned by kube-admin, possibly gaining access to privileged service account tokens.

Comment 1 Mark Cooper 2020-06-24 07:49:28 UTC

Acknowledgments:

Name: Daniel Grimm (Red Hat)

Comment 5 errata-xmlrpc 2020-07-01 18:46:31 UTC

This issue has been addressed in the following products:

  OpenShift Service Mesh 1.1

Via RHSA-2020:2795 https://access.redhat.com/errata/RHSA-2020:2795

Comment 6 Product Security DevOps Team 2020-07-01 19:28:13 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14306

Comment 8 Mark Cooper 2020-07-02 00:59:09 UTC

Fix: https://github.com/maistra/istio-operator/pull/462