OCPBUGS-29793: [release-4.15] Address https://github.com/advisories/GHSA-fg9q-5cw2-p6r9: Restrict access to infrastructure PVCs by requiring matching infraClusterLabels on tenant PVCs

[mhenriks]

The CVE describes how an attacker may create a PV/PVC in a guest cluster to access any PVC in the infra cluster namespace. The infra clusters may belong to other guest clusters or have been created out of band from the kubevirt-csi driver.

This PR addresses the issue by:

1. infraClusterLabels are required (but is up to admin to make sure they are unique per tenant)
2. guest may only access infra PVCs with matching labels
3. guest can only access PVCs with specific prefix (default is "pvc-")

Shoutout to awels who actually implemented this based on input from davidvossel.

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Release note:

Address CVE-2024-1725 - PV allows access to HCP's root node

[openshift-ci-robot]

@mhenriks: No Jira issue with key CVE-2024 exists in the tracker at https://issues.redhat.com/.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

In response to this:

The CVE describes how an attacker may create a PV/PVC in a guest cluster to access any PVC in the infra cluster namespace. The infra clusters may belong to other guest clusters or have been created out of band from the kubevirt-csi driver.

This PR addresses the issue by:

1. infraClusterLabels are required (but is up to admin to make sure they are unique per tenant)
2. guest may only access infra PVCs with matching labels
3. guest can only access PVCs with specific prefix (default is "pvc-")

Shoutout to awels who actually implemented this based on input from davidvossel.

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Release note:

Address CVE-2024-1725 - PV allows access to HCP's root node

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[davidvossel]

/re-title OCPBUGS-29793: [release-4.15] Address CVE-2024-1725: Restrict access to infrastructure PVCs by requiring matching infraClusterLabels on tenant PVCs

[davidvossel]

/jira refresh

[openshift-ci-robot]

@davidvossel: No Jira issue with key CVE-2024 exists in the tracker at https://issues.redhat.com/.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@davidvossel: The referenced Jira(s) [CVE-2024] could not be located, all automatically applied jira labels will be removed.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[davidvossel]

/retitle OCPBUGS-29793: [release-4.15] Address GHSA-fg9q-5cw2-p6r9: Restrict access to infrastructure PVCs by requiring matching infraClusterLabels on tenant PVCs

[openshift-ci-robot]

@mhenriks: This pull request references Jira Issue OCPBUGS-29793, which is invalid:

• expected Jira Issue OCPBUGS-29793 to depend on a bug targeting a version in 4.16.0 and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

The CVE describes how an attacker may create a PV/PVC in a guest cluster to access any PVC in the infra cluster namespace. The infra clusters may belong to other guest clusters or have been created out of band from the kubevirt-csi driver.

This PR addresses the issue by:

1. infraClusterLabels are required (but is up to admin to make sure they are unique per tenant)
2. guest may only access infra PVCs with matching labels
3. guest can only access PVCs with specific prefix (default is "pvc-")

Shoutout to awels who actually implemented this based on input from davidvossel.

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Release note:

Address CVE-2024-1725 - PV allows access to HCP's root node

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[davidvossel]

/jira-refresh

[davidvossel]

/jira refresh

[openshift-ci-robot]

@davidvossel: This pull request references Jira Issue OCPBUGS-29793, which is invalid:

• expected dependent Jira Issue OCPBUGS-30839 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[davidvossel]

/jira refresh

[openshift-ci-robot]

@davidvossel: This pull request references Jira Issue OCPBUGS-29793, which is invalid:

• expected dependent Jira Issue OCPBUGS-30839 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[davidvossel]

/jira-refresh

[davidvossel]

/jira refresh

[openshift-ci-robot]

@davidvossel: This pull request references Jira Issue OCPBUGS-29793, which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.15.z) matches configured target version for branch (4.15.z)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
• dependent bug Jira Issue OCPBUGS-30839 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
• dependent Jira Issue OCPBUGS-30839 targets the "4.16.0" version, which is one of the valid target versions: 4.16.0
• bug has dependents

Requesting review from QA contact:
/cc @LiangquanLi930

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[davidvossel]

I know this test didn't exist previously in this branch, but can we get the client_test.go unit tests ported as well? I think that would mean taking the client_test.go file from main and stripping out just the tests in the Context("Snapshot class", func() { section for the backport.

I'm pretty confident your PR works. My concern about backporting the unit tests is ensuring we lock in these changes when future backports occur. I want to make sure we've done our due diligence to prevent a regression especially since this is a CVE.

[davidvossel]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: davidvossel, mhenriks

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [davidvossel]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@mhenriks: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[davidvossel]

/label backport-risk-assessed
/label cherry-pick-approved

[openshift-ci-robot]

@mhenriks: Jira Issue OCPBUGS-29793: All pull requests linked via external trackers have merged:

• openshift/kubevirt-csi-driver#33

Jira Issue OCPBUGS-29793 has been moved to the MODIFIED state.

In response to this:

The CVE describes how an attacker may create a PV/PVC in a guest cluster to access any PVC in the infra cluster namespace. The infra clusters may belong to other guest clusters or have been created out of band from the kubevirt-csi driver.

This PR addresses the issue by:

1. infraClusterLabels are required (but is up to admin to make sure they are unique per tenant)
2. guest may only access infra PVCs with matching labels
3. guest can only access PVCs with specific prefix (default is "pvc-")

Shoutout to awels who actually implemented this based on input from davidvossel.

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Release note:

Address CVE-2024-1725 - PV allows access to HCP's root node

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-bot]

[ART PR BUILD NOTIFIER]

This PR has been included in build ose-kubevirt-csi-driver-container-v4.15.0-202403201702.p0.gd3bdbce.assembly.stream.el8 for distgit ose-kubevirt-csi-driver-rhel8.
All builds following this will include this PR.

[openshift-merge-robot]

Fix included in accepted release 4.15.0-0.nightly-2024-03-22-044446