CVE-2020-8562
Bypass of Kubernetes API Server proxy TOCTOU
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.
Como mitigación a un informe de 2019 y CVE-2020-8555, Kubernetes intenta impedir que las conexiones proxy accedan a las redes link-local o localhost cuando son realizadas conexiones impulsadas por el usuario a los servicios, pods, nodos o proveedores de servicios StorageClass. Como parte de esta mitigación, Kubernetes realiza una comprobación de resolución de nombres DNS y comprueba que las IPs de respuesta no estén en el rango link-local (169.254.0.0/16) o localhost (127.0.0/8). A continuación, Kubernetes lleva a cabo una segunda resolución de DNS sin comprobar para la conexión real. Si un servidor DNS no estándar devuelve diferentes respuestas no almacenadas en caché, un usuario puede ser capaz de omitir la restricción de la IP del proxy y acceder a redes privadas en el plano de control
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-02-03 CVE Reserved
- 2022-02-01 CVE Published
- 2023-12-19 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://github.com/kubernetes/kubernetes/issues/101493 | Issue Tracking | |
https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY | Mailing List | |
https://security.netapp.com/advisory/ntap-20220225-0002 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | <= 1.18.18 Search vendor "Kubernetes" for product "Kubernetes" and version " <= 1.18.18" | - |
Affected
| ||||||
Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.19.0 <= 1.19.10 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.19.0 <= 1.19.10" | - |
Affected
| ||||||
Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.20.0 <= 1.20.6 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.20.0 <= 1.20.6" | - |
Affected
| ||||||
Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | 1.21.0 Search vendor "Kubernetes" for product "Kubernetes" and version "1.21.0" | - |
Affected
|