Bug 2375801 (CVE-2025-5187)

Summary: CVE-2025-5187 kubernetes: kube-apiserver: Nodes can delete themselves by adding an OwnerReference
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, kshier, omaciel, security-response-team, stcannon, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A vulnerability was found in the kube-apiserver's NodeRestriction admission controller, where node users can delete their corresponding node object by setting their own OwnerReference to a cluster-scoped resource. This flaw allows an attacker to delete and recreate its node object, leading to the node being recreated with modified taints or labels, which should not be allowed in this context. This may let the attacker control which pods are running on the compromised node.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2399793, 2399794    
Bug Blocks:    
Deadline: 2025-08-12   

Description OSIDB Bzimport 2025-07-01 19:46:43 UTC 
A vulnerability exists in the NodeRestriction admission controller where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection. By default, node 
users are authorized for create and patch requests but not delete requests against their node object. Since the NodeRestriction admission controller does not prevent patching OwnerReferences, a compromised node could leverage this vulnerability to delete and then recreate its node object. This would permit the node object to be recreated with modified taints or labels which are normally rejected by this plugin. Modifying taints or labels on a node could allow an attacker to control which pods are running on the compromised node.
Comment 5 Pedro Sampaio 2025-09-18 12:53:51 UTC 
Fixing Advisories.

https://access.redhat.com/errata/RHBA-2025:15714
https://access.redhat.com/errata/RHBA-2025:15694