Bug 2242173 (CVE-2023-5408)

Summary:	CVE-2023-5408 OpenShift: modification of node role labels
Product:	[Other] Security Response	Reporter:	Nick Tait <ntait>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dfreiber, jburrell, mpatel, pescorza, rogbas, security-response-team, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the cluster.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2242171

Description Nick Tait 2023-10-04 17:59:39 UTC

A flaw was discovered in the node restriction admission plugin of the kubernetes api server of OpenShift. It could allow steering workloads from the control plane and etcd nodes onto a different worker node and gain higher credentials on the cluster.

Comment 8 errata-xmlrpc 2023-10-30 13:49:28 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:6130 https://access.redhat.com/errata/RHSA-2023:6130

Comment 9 errata-xmlrpc 2023-10-31 12:54:56 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2023:5006 https://access.redhat.com/errata/RHSA-2023:5006

Comment 12 errata-xmlrpc 2023-11-16 20:31:57 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2023:6842 https://access.redhat.com/errata/RHSA-2023:6842

Comment 13 errata-xmlrpc 2023-11-29 01:41:23 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.11

Via RHSA-2023:7479 https://access.redhat.com/errata/RHSA-2023:7479