CVSS: 9.6EPSS: 0%CPEs: 7EXPL: 1CVE-2017-1002101 – kubernetes: Volume security can be sidestepped with innocent emptyDir and subpath
https://notcve.org/view.php?id=CVE-2017-1002101
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem. En Kubernetes, en versiones 1.3.x, 1.4.x, 1.5.x, 1.6.x y en versiones anteriores a la 1.7.14, 1.8.9 y 1.9.4, los contenedores que emplean montajes de volumen subpath con cualquier tipo de volumen (incluyendo pods no privilegiados, dependientes de los permisos de archivo) pueden acceder a archivos/directorios fuera del volumen, incluyendo el sistema de archivos del host. It was found that volume security can be sidestepped with innocent emptyDir and subpath. This could give an attacker with access to a pod full control over the node host by gaining access to docker socket. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html https://access.redhat.com/errata/RHSA-2018:0475 https://github.com/bgeesaman/subpath-exploit https://github.com/kubernetes/kubernetes/issues/60813 https://access.redhat.com/security/cve/CVE-2017-1002101 https://bugzilla.redhat.com/show_bug.cgi?id=1525130 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1002102 – kubernetes: Malicious containers can delete any file from the node
https://notcve.org/view.php?id=CVE-2017-1002102
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running. En Kubernetes, en versiones 1.3.x, 1.4.x, 1.5.x, 1.6.x y en versiones anteriores a la 1.7.14, 1.8.9 y 1.9.4, los contenedores que emplean un volumen secreto, configMap, proyectado o downwardAPI pueden desencadenar la eliminación de archivos/directorios arbitrarios de los nodos en los que se están ejecutando. This vulnerability allows containers using a secret, configMap, projected, or downwardAPI volume to trigger deletion of arbitrary files and directories on the nodes where they are running. An attacker could use this flaw to delete arbitrary file or directories on node host. • https://access.redhat.com/errata/RHSA-2018:0475 https://github.com/kubernetes/kubernetes/issues/60814 https://access.redhat.com/security/cve/CVE-2017-1002102 https://bugzilla.redhat.com/show_bug.cgi?id=1551818 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •