Bug 1993749 (CVE-2021-25741)

Summary:	CVE-2021-25741 kubernetes: Symlink exchange can allow host filesystem access
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aos-bugs, bdettelb, bmontgom, eparis, jburrell, jdobson, joelsmith, jokerman, jsafrane, lhinds, mfojtik, nstielau, rphillips, security-response-team, sfowler, shardy, sponnaga, sreber, sttts, swachira, tmanor, tomckay, tsmetana, vkumar, vlaad, xxia
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kubernetes 1.22.2, kubernetes 1.21.5, kubernetes 1.20.11, kubernetes 1.19.15	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in kubernetes. An authorized user can exploit this by creating pods with crafted subpath volume mounts to access files and directories outside of the volume, including on the host node's filesystem.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-28 06:21:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1993752, 1993753, 1993754, 1993755, 1993756
Bug Blocks:	1993750

Description Sam Fowler 2021-08-16 05:16:20 UTC

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

Environments where cluster administrators have restricted the ability to create hostPath mounts are the most seriously affected. Exploitation allows hostPath-like access without use of the hostPath feature, thus bypassing the restriction.

In a default Kubernetes environment, exploitation could be used to obscure misuse of already-granted privileges.

Comment 31 Sam Fowler 2021-09-16 01:45:30 UTC

Upstream issue:

https://github.com/kubernetes/kubernetes/issues/104980

Comment 34 errata-xmlrpc 2021-09-27 19:07:00 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2021:3631 https://access.redhat.com/errata/RHSA-2021:3631

Comment 35 Product Security DevOps Team 2021-09-28 06:21:07 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-25741

Comment 36 errata-xmlrpc 2021-09-29 11:46:38 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2021:3642 https://access.redhat.com/errata/RHSA-2021:3642

Comment 37 errata-xmlrpc 2021-09-29 14:24:21 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.7

Via RHSA-2021:3635 https://access.redhat.com/errata/RHSA-2021:3635

Comment 38 errata-xmlrpc 2021-09-30 19:29:00 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2021:3646 https://access.redhat.com/errata/RHSA-2021:3646