CVSS Rating: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - MEDIUM (6.1)

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

This issue has been rated Medium (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), and assigned CVE-2024-5321.

Am I vulnerable?

Any Kubernetes environment with Windows nodes is affected. Run kubectl get nodes -l kubernetes.io/os=windows to see if any Windows nodes are in use.

Affected Versions

• kubelet <= 1.27.15
• kubelet <= 1.28.11
• kubelet <= 1.29.6
• kubelet <= 1.30.2

How do I mitigate this vulnerability?

This issue can be mitigated by applying the patch provided. The patch includes changes to pkg/util/filesystem that set file permissions on Windows and hardens the permissions for container logs for containers running on Windows.

Fixed Versions

• kubelet 1.27.16
• kubelet 1.28.12
• kubelet 1.29.7
• kubelet 1.30.3

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/

Detection

Any Kubernetes environment with Windows nodes is affected. Run kubectl get nodes -l kubernetes.io/os=windows to see if any Windows nodes are in use.

If you find evidence that this vulnerability has been exploited, please contact [email protected]

Acknowledgements

This vulnerability was reported by Paulo Gomes @pjbgf from SUSE.

The issue was fixed and coordinated by the fix team:
Mark Rossetti @marosset
James Sturtevant @jsturtevant
Craig Ingram @cji
Rita Zhang @ritazh

and release managers:
Sascha Grunert @saschagrunert
Jeremy Rickard @jeremyrickard
Carlos Panato @cpanato
Jim Angel @jimangel

/area security
/kind bug
/committee security-response
/sig windows
/area kubelet
/triage accepted
/lifecycle frozen