CVE-2023-3676: Insufficient input sanitization on Windows nodes leads to privilege escalation

[enj]

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH (8.8)

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

Am I vulnerable?

Any kubernetes environment with Windows nodes is impacted. Run kubectl get nodes -l kubernetes.io/os=windows to see if any Windows nodes are in use.

Affected Versions

• kubelet <= v1.28.0
• kubelet <= v1.27.4
• kubelet <= v1.26.7
• kubelet <= v1.25.12
• kubelet <= v1.24.16

How do I mitigate this vulnerability?

The provided patch fully mitigates the vulnerability and has no known side effects. Full mitigation for this class of issues requires patches applied for CVE-2023-3676, CVE-2023-3955, and CVE-2023-3893.

Outside of applying the provided patch, there are no known mitigations to this vulnerability.

Fixed Versions

• kubelet master - fixed by Use env variables for passing path and subpath to Powershell #120127
• kubelet v1.28.1 - fixed by Cherry pick of #120127 Use env variables for passing path and subpath to Powershell #120129
• kubelet v1.27.5 - fixed by Cherry pick of #120127 Use env variables for passing path and subpath to Powershell #120130
• kubelet v1.26.8 - fixed by Cherry pick of #120127 Use env variables for passing path and subpath to Powershell #120131
• kubelet v1.25.13 - fixed by Cherry pick of #120127 Use env variables for passing path and subpath to Powershell #120132
• kubelet v1.24.17 - fixed by Cherry pick of #120127 Use env variables for passing path and subpath to Powershell #120133

To upgrade, refer to the documentation:
https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/

Detection

Kubernetes audit logs can be used to detect if this vulnerability is being exploited. Pod create events with embedded powershell commands are a strong indication of exploitation. Config maps and secrets that contain embedded powershell commands and are mounted into pods are also a strong indication of exploitation.

If you find evidence that this vulnerability has been exploited, please contact [email protected]

Acknowledgements

This vulnerability was reported by Tomer Peled @tomerpeled92

The issue was fixed and coordinated by the fix team:

James Sturtevant @jsturtevant
Mark Rossetti @marosset
Andy Zhang @andyzhangx
Justin Terry @jterry75
Kulwant Singh @KlwntSingh
Micah Hausler @micahhausler
Rita Zhang @ritazh

and release managers:

Jeremy Rickard @jeremyrickard

/triage accepted
/lifecycle frozen
/area security
/kind bug
/committee security-response

[jeremyrickard]

/area security
/kind bug
/committee security-response
/label official-cve-feed
/sig windows
/area kubelet

[k8s-ci-robot]

@jeremyrickard: Can not set label official-cve-feed: Must be member in one of these teams: [security-response-committee]

In response to this:

/area security
/kind bug
/committee security-response
/label official-cve-feed
/sig windows
/area kubelet

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ritazh]

/label official-cve-feed