Issue Details
A security issue was reported in kOps with the GCP Provider running in Gossip Mode, where Node service account credentials could be used by a container running in the cluster to retrieve sensitive information from the state storage bucket and escalate to cluster-admin permissions.
This issue has been rated High (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and assigned CVE-2023-1943.
Affected Components and Configurations
This bug affects the kOps GCP provider, only when running in Gossip Mode. See below for information about other providers.
Affected Versions- v1.26.0 - v1.26.1
- <v1.25.4
Fixed Versions- v1.26.2
- V1.25.4
Recent kOps improvements have systematically reduced the potential for this class of attacks, by reducing or eliminating cloud credentials/privileges on the nodes. The recommended versions vary by cloud:
AWS users: should not be affected in recent versions. kOps version 1.26 (or later) is recommended, but not a critical update.
GCE users: recommended kOps version is 1.26.3 (or later).
DigitalOcean users: recommended kOps version is 1.27.0-alpha.2 (or later), with --dns=none for new clusters. Cloud credentials have been removed from the nodes in this configuration. Future versions will likely make dns=none the default.
Hetzner users: recommended kOps version is 1.27.0-alpha.2 (or later). Cloud credentials have been removed from the nodes in this configuration.
(Azure, Scaleway and other cloud providers are following the same approach, but as these are in alpha we recommend using the latest kOps version, and generally do not recommend production usage when in alpha).
Detection
If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io
Additional Details
See kOps Issue #15539 for more details.
Acknowledgements
This vulnerability was reported by James Cleverley-Prance
Thank You,
CJ Cullen on behalf of the Kubernetes Security Response Committee