Bug 1891051 (CVE-2020-8554)
| Summary: | CVE-2020-8554 kubernetes: MITM using LoadBalancer or ExternalIPs | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | admiller, anowak, aos-bugs, aos-install, bmontgom, cdc, eparis, go-sig, hchiramm, hvyas, jbrooks, jburrell, jcajka, jchaloup, jmulligan, joelsmith, jokerman, madam, mfojtik, nhorman, nstielau, puebele, rhs-bugs, security-response-team, sfowler, sponnaga, sreber, stclairt, storage-qa-internal, strigazi, sttts, vbatts, xxia |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in kubernetes. If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods (or nodes) in the cluster.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-01-20 17:59:18 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1891801, 1891802, 1891803, 1891804, 1904767, 1904768, 1910192 | ||
| Bug Blocks: | 1891053 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-10-23 17:03:58 UTC
ExternalIP admission plugin prevents this from being exploited, added in OpenShift v1: https://github.com/openshift/origin/commit/290ade01c6c27e835a2b9132fce839234fc4ea27 Acknowledgments: Name: the Kubernetes Product Security Committee Upstream: Etienne Champetier (Anevia) Mitigation: ExternalIP addresses ranges can be configured as described below. OCP 4 is secure by default, though cluster-admins can whitelist externalIP addresses as needed. OCP 3.11 can be secured by changing `externalIPNetworkCIDR` to "0.0.0.0/32", which blocks all externalIP address values. https://docs.openshift.com/container-platform/4.6/networking/configuring_ingress_cluster_traffic/configuring-externalip.html https://docs.openshift.com/container-platform/3.11/admin_guide/tcp_ingress_external_ports.html#service-externalip Users can check if they have permission to patch the Status of a LoadBalancer Service with the command: `kubectl auth can-i patch service --subresource=status`. In OCP, by default only cluster-admins are granted this permission. The default master.config installed in OCP 3.11 sets externalIPNetworkCIDRs to 0.0.0.0/0, which allows all IP addresses: https://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_control_plane/templates/master.yaml.v1.j2#L139 E.g.: $ cat /etc/origin/master/master-config.yaml ... networkConfig: externalIPNetworkCIDRs: - 0.0.0.0/0 ... External References: https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8 https://blog.champtar.fr/K8S_MITM_LoadBalancer_ExternalIPs/ Created kubernetes tracking bugs for this issue: Affects: fedora-all [bug 1910192] Statement: OpenShift Container Platform (OCP) includes a builtin externalIP admission plugin, which restricts the use of Service eternalIPs to those configured by a cluster-admin. In OCP4 all externalIP ranges are disabled by default. In OCP 3.11, the default range is "0.0.0.0/0", which allows all IP addresses. The second attack vector, via patching the Status of a LoadBalancer Service, is not possible unless permission to patch service/status is granted. OCP does not grant this permission to users who are not cluster-admins. OCP 4 is not affected by this vulnerability as it is secure by default. OCP 3.11 is affected, however the vulnerability can be by mitigated by configuring the builtin externalIP admission plugin. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.11 Via RHSA-2021:0079 https://access.redhat.com/errata/RHSA-2021:0079 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-8554 |