Bug 2214402 (CVE-2024-0793)

Summary:	CVE-2024-0793 kube-controller-manager: malformed HPA v1 manifest causes crash
Product:	[Other] Security Response	Reporter:	Anten Skrabec <askrabec>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anjoseph, dfreiber, drow, jburrell, joelsmith, jprabhak, rogbas, security-response-team, vkumar, wtam
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2213618

Description Anten Skrabec 2023-06-12 21:05:53 UTC

The problem in particular is with the annotation "
autoscaling.alpha.kubernetes.io/behavior" when it doesn't have a definition
for scaling up, The cluster accepts the manifest but it seems that it fills
with "nil" the scale up portion and it causes the kube-controller-manager
pods to crash and go into crashloopbackoff.

The logs of the kube-controller-manager component show an error referencing
invalid memory address or nil pointer dereference which causes the pod to
die.

Comment 7 errata-xmlrpc 2024-03-20 01:50:59 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2024:1267 https://access.redhat.com/errata/RHSA-2024:1267