CVE-2021-25735: Validating Admission Webhook does not observe some previous fields

[cjcullen]

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. You are only affected by this vulnerability if you run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object.

This issue has been rated Medium (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H), and assigned CVE-2021-25735.

Note: This only impacts validating admission plugins that rely on old values in certain fields, and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.

Affected Versions

• kube-apiserver v1.20.0 - v1.20.5
• kube-apiserver v1.19.0 - v1.19.9
• kube-apiserver <= v1.18.17

Fixed Versions

This issue is fixed in the following versions:

• kube-apiserver v1.21.0 - Fixed by refine validation #99946
• kube-apiserver v1.20.6 - Fixed by Automated cherry pick of #99946: tweak validation to avoid mutation #100315
• kube-apiserver v1.19.10 - Fixed by Automated cherry pick of #99946: tweak validation to avoid mutation #100316
• kube-apiserver v1.18.18 - Fixed by Automated cherry pick of #99946: tweak validation to avoid mutation #100317

Detection

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

Acknowledgements

This vulnerability was reported by Rogerio Bastos & Ari Lima from RedHat

[k8s-ci-robot]

@cjcullen: This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[denisse-dev]

Hi, do you know if this vulnerability can be exploited remotely?

[tallclair]

@da-edra Anyone authorized to update or patch nodes can potentially exploit this. So yes, it can be exploited remotely with proper authorization.

[denisse-dev]

@tallclair thanks. :)

[acyberrain]

@tallclair Found this: https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/
Is this actually bypassing the authorization, or still need to have some privileged access?

[PushkarJ]

/label official-cve-feed

(Related to kubernetes/sig-security#1)