Bug 1891051 (CVE-2020-8554) - CVE-2020-8554 kubernetes: MITM using LoadBalancer or ExternalIPs
Summary: CVE-2020-8554 kubernetes: MITM using LoadBalancer or ExternalIPs
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-8554
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1891801 1891802 1891803 1891804 1910192 1904767 1904768
Blocks: 1891053
TreeView+ depends on / blocked
 
Reported: 2020-10-23 17:03 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-06-15 13:57 UTC (History)
33 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in kubernetes. If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods (or nodes) in the cluster.
Clone Of:
Environment:
Last Closed: 2021-01-20 17:59:18 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:0079 0 None None None 2021-01-20 16:52:44 UTC

Description Guilherme de Almeida Suckevicz 2020-10-23 17:03:58 UTC
A security issue was discovered with Kubernetes affecting multitenant clusters. If a potential attacker can already create or edit services and pods, then they may be able to intercept traffic from other pods (or nodes) in the cluster.

Comment 4 Sam Fowler 2020-12-02 07:04:40 UTC
ExternalIP admission plugin prevents this from being exploited, added in OpenShift v1:

https://github.com/openshift/origin/commit/290ade01c6c27e835a2b9132fce839234fc4ea27

Comment 8 Sam Fowler 2020-12-06 09:20:29 UTC
Acknowledgments:

Name: the Kubernetes Product Security Committee
Upstream: Etienne Champetier (Anevia)

Comment 17 Sam Fowler 2020-12-14 00:59:01 UTC
Mitigation:

ExternalIP addresses ranges can be configured as described below. OCP 4 is secure by default, though cluster-admins can whitelist externalIP addresses as needed. OCP 3.11 can be secured by changing `externalIPNetworkCIDR` to "0.0.0.0/32", which blocks all externalIP address values.

https://docs.openshift.com/container-platform/4.6/networking/configuring_ingress_cluster_traffic/configuring-externalip.html
https://docs.openshift.com/container-platform/3.11/admin_guide/tcp_ingress_external_ports.html#service-externalip

Users can check if they have permission to patch the Status of a LoadBalancer Service with the command: `kubectl auth can-i patch service --subresource=status`. In OCP, by default only cluster-admins are granted this permission.

Comment 18 Sam Fowler 2020-12-14 01:04:35 UTC
The default master.config installed in OCP 3.11 sets externalIPNetworkCIDRs to 0.0.0.0/0, which allows all IP addresses:

https://github.com/openshift/openshift-ansible/blob/release-3.11/roles/openshift_control_plane/templates/master.yaml.v1.j2#L139

E.g.:

$ cat /etc/origin/master/master-config.yaml
...
networkConfig:
  externalIPNetworkCIDRs:
  - 0.0.0.0/0
...

Comment 20 Sam Fowler 2020-12-23 02:52:35 UTC
Created kubernetes tracking bugs for this issue:

Affects: fedora-all [bug 1910192]

Comment 21 Sam Fowler 2020-12-23 03:40:57 UTC
Statement:

OpenShift Container Platform (OCP) includes a builtin externalIP admission plugin, which restricts the use of Service eternalIPs to those configured by a cluster-admin. In OCP4 all externalIP ranges are disabled by default. In OCP 3.11, the default range is "0.0.0.0/0", which allows all IP addresses.

The second attack vector, via patching the Status of a LoadBalancer Service, is not possible unless permission to patch service/status is granted. OCP does not grant this permission to users who are not cluster-admins.

OCP 4 is not affected by this vulnerability as it is secure by default. OCP 3.11 is affected, however the vulnerability can be by mitigated by configuring the builtin externalIP admission plugin.

Comment 22 errata-xmlrpc 2021-01-20 16:52:41 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2021:0079 https://access.redhat.com/errata/RHSA-2021:0079

Comment 23 Product Security DevOps Team 2021-01-20 17:59:18 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-8554


Note You need to log in before you can comment on or make changes to this bug.