Bug 2176267 (CVE-2023-1260)

Summary: CVE-2023-1260 kube-apiserver: PrivEsc
Product: [Other] Security Response Reporter: Nick Tait <ntait>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: antoine.tran.11w, dfreiber, jburrell, joelsmith, rogbas, vkumar, yaoli
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: github.com/openshift/apiserver-library-go 0.0.0-20230621 Doc Type: If docs needed, set a value
Doc Text:
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-07-20 22:43:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2176262    

Description Nick Tait 2023-03-07 20:19:01 UTC
'''
We've discovered a privilege escalation issue in the OpenShift platform.

Conditions for the privilege escalation:
- a user must be granted the ability to "update, patch" the 
"pods/ephemeralcontainers" subresource
     - by default, NEITHER common users NOR Service Accounts are granted 
this permission by the platform
- with the above permission, a user is able to patch a running pod 
they've got access to and bypass SCC admission
     - this means, a user can create a "privileged" container, which 
allows them obtaining access to the pod's node resources

The step-by-step reproducer is described in 
https://issues.redhat.com/browse/OCPBUGS-7181.

Affected OpenShift Container Platform versions: 4.10 and newer.
Affected component: kube-apiserver (and the platforms that use it)

The bug is located within the apiserver-library-go repository in the 
following module: 
https://github.com/openshift/apiserver-library-go/tree/master/pkg/securitycontextconstraints. 
We are yet to determine how to fix it.

The workaround is to remove the permissions to "update, patch" the 
"pods/ephemeralcontainers" subresource from any low-privileged users, if 
there are any that currently hold it.
'''

From Stanislav Láznička

Comment 7 yaoli 2023-06-09 01:15:40 UTC
Hello Team

The customer want to know about the CVE process, May I know when we had plan to fix the issue?

Thanks

Comment 9 errata-xmlrpc 2023-07-12 04:07:21 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2023:3976 https://access.redhat.com/errata/RHSA-2023:3976

Comment 11 errata-xmlrpc 2023-07-20 17:28:52 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13
  Ironic content for Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:4093 https://access.redhat.com/errata/RHSA-2023:4093

Comment 12 Product Security DevOps Team 2023-07-20 22:43:07 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 13 Product Security DevOps Team 2023-07-21 03:20:42 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 14 Product Security DevOps Team 2023-07-21 08:43:27 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 15 Product Security DevOps Team 2023-07-21 13:26:59 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 16 Product Security DevOps Team 2023-07-21 18:44:45 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 17 Product Security DevOps Team 2023-07-21 23:26:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 18 Product Security DevOps Team 2023-07-22 04:44:12 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 19 Product Security DevOps Team 2023-07-22 09:27:00 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 20 Product Security DevOps Team 2023-07-22 14:46:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 21 Product Security DevOps Team 2023-07-22 19:27:01 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 22 Product Security DevOps Team 2023-07-23 00:44:46 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 23 Product Security DevOps Team 2023-07-23 05:27:24 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 24 Product Security DevOps Team 2023-07-23 10:44:05 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 25 Product Security DevOps Team 2023-07-23 15:27:01 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 26 Product Security DevOps Team 2023-07-23 20:45:06 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 27 Product Security DevOps Team 2023-07-24 01:27:00 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 28 Product Security DevOps Team 2023-07-24 06:46:07 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 29 Product Security DevOps Team 2023-07-24 11:27:01 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 30 Product Security DevOps Team 2023-07-24 16:45:56 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 31 Product Security DevOps Team 2023-07-24 21:27:00 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 32 Product Security DevOps Team 2023-07-25 02:46:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 33 Product Security DevOps Team 2023-07-25 07:46:58 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 34 Product Security DevOps Team 2023-07-25 12:53:15 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 35 Product Security DevOps Team 2023-07-25 17:47:00 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 36 Product Security DevOps Team 2023-07-25 22:52:59 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 37 Product Security DevOps Team 2023-07-26 03:46:52 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 38 Product Security DevOps Team 2023-07-26 08:52:44 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 39 Product Security DevOps Team 2023-07-26 13:46:59 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 40 Product Security DevOps Team 2023-07-26 18:52:13 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 41 Product Security DevOps Team 2023-07-26 23:46:57 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 42 Product Security DevOps Team 2023-07-27 04:53:57 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1260

Comment 43 errata-xmlrpc 2023-08-02 01:09:23 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.11

Via RHSA-2023:4312 https://access.redhat.com/errata/RHSA-2023:4312

Comment 44 errata-xmlrpc 2023-09-06 01:18:37 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.10

Via RHSA-2023:4898 https://access.redhat.com/errata/RHSA-2023:4898

Comment 45 errata-xmlrpc 2023-10-31 14:20:05 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2023:5008 https://access.redhat.com/errata/RHSA-2023:5008

Comment 49 Antoine TRAN 2025-03-03 19:56:49 UTC
Dear Redhat team,

Can I ask if in the corrected OpenShift version (>=4.11), it is now OK to give these privilege

{APIGroups:[""], Resources:["pods/ephemeralcontainers"], Verbs:["patch" "update"]}
{APIGroups:[""], Resources:["pods/status"], Verbs:["patch" "update"]}

to users without risking escalation privilege as described in this ticket?

Comment 50 Antoine TRAN 2025-03-04 13:40:24 UTC
Created a new issue https://bugzilla.redhat.com/show_bug.cgi?id=2349782 to ask about granting these privilege by default.