Catégorie : Kubernetes (AKS)

AKS Security in French | Slides

Hello :),

J’ai eu l’opportunuité de donner une présentation en français sur la sécurité des clusters AKS pour le Microsoft Reactor Toronto.

Vous retrouverez ci-dessous les slides de cette présentation:

Loader Loading...
EAD Logo Taking too long?

Reload Reload document
| Open Open in new tab

Merci aux nombreux participants.

Maxime.

AKS |Azure Kubernetes Service: Node disk DOS by writing to container /etc/hosts (CVE-2020-8557)

Hi,

In this article I would like share with you a new vulnerability against Azure Kubernetes.

Title: Node disk DOS by writing to container /etc/hosts

CVE: CVE-2020-8557

Description:

The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.

Any clusters allowing pods with sufficient privileges to write to their own /etc/hosts files are affected. This includes containers running with CAP_DAC_OVERRIDE in their capabilities bounding set (true by default) and either UID 0 (root) or a security context with allowPrivilegeEscalation: true (true by default).

Affected versions:

kubelet v1.18.0-1.18.5
kubelet v1.17.0-1.17.8
kubelet < v1.16.13

Fixed versions:

AKS v1.15.11*, v1.15.12* .
AKS v1.16.10* and v1.16.13+
AKS v1.17.7* and v1.17.9+
AKS v1.18.6+

Maxime.

AKS | Azure Kubernetes Service: Privilege escalation from compromised node to cluster (CVE-2020-8559)

Hi,

In this article I would like share with you a new vulnerability against Azure Kubernetes.

Title: Privilege escalation from compromised node to cluster

CVE: CVE-2020-8559

Description:

If an attacker is able to intercept certain requests to the Kubelet within Azure Kubernetes Service (AKS), they can send a redirect response that may be followed by a client using the credentials from the original request. This can lead to compromise of other nodes.

If multiple clusters share the same certificate authority trusted by the client, and the same authentication credentials, this vulnerability may allow an attacker to redirect the client to another cluster. In this configuration, this vulnerability should be considered High severity.

Note that this vulnerability requires an attacker to first compromise a node through separate means.

Affected versions:

AKS patches all GA kubernetes versions control plane components automatically.

  • kube-apiserver <v1.18.6
  • kube-apiserver <v1.17.7
  • kube-apiserver <v1.16.10
  • and all kube-apiserver versions prior to v1.15.11

Fixed versions:

  • kube-apiserver v1.18.6+
  • kube-apiserver v1.17.7+
  • kube-apiserver v1.16.10+

Maxime.