Bug 1946538 (CVE-2021-25736)

Summary:	CVE-2021-25736 kubernetes: LoadBalancer Service type don't create a HNS policy for empty or invalid external loadbalancer IP, what could lead to MITM
Product:	[Other] Security Response	Reporter:	Przemyslaw Roguski <proguski>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bmontgom, eparis, jburrell, jokerman, nstielau, security-response-team, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kubernetes 1.21.0, kubernetes 1.20.6, kubernetes 1.19.10, kubernetes 1.18.18	Doc Type:	---
Doc Text:	A flaw was found in the Windows kube-proxy component. In a cloud environment that does not set the “.status.loadBalancer.ingress.ip” field in the LoadBalancer service status configuration (for example in AWS) the packets can be misrouted and reach an unintended destination.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-23 10:40:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1946628
Bug Blocks:	1918517

Description Przemyslaw Roguski 2021-04-06 11:23:19 UTC

In Windows kube-proxy component when a service of type “LoadBalancer” is created, packets can be misrouted and reach an unintended destination.
This issue can be only observed on any cloud environment that does not set the “.status.loadBalancer.ingress.ip” field in the LoadBalancer service status configuration. For one example, Kubernetes environments integrating with AWS cloud load balancers are impacted as they currently set “.status.loadBalancer.ingress.hostname” instead.
This could leading to potential MITM attack.

Comment 1 Przemyslaw Roguski 2021-04-06 11:23:24 UTC

Acknowledgments:

Name: Eric Paris (Red Hat), Christian Hernandez (Red Hat)

Comment 5 Sam Fowler 2021-05-11 07:23:36 UTC

External References:

https://groups.google.com/g/kubernetes-security-announce/c/lIoOPObO51Q

Comment 6 Przemyslaw Roguski 2021-05-11 07:33:31 UTC

Statement:

Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.

Comment 7 errata-xmlrpc 2021-06-23 05:38:02 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.7

Via RHSA-2021:2130 https://access.redhat.com/errata/RHSA-2021:2130

Comment 8 Product Security DevOps Team 2021-06-23 10:40:27 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-25736