CVE-2021-25736
Windows kube-proxy LoadBalancer contention
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Kube-proxy
on Windows can unintentionally forward traffic to local processes
listening on the same port (“spec.ports[*].port”) as a LoadBalancer
Service when the LoadBalancer controller
does not set the “status.loadBalancer.ingress[].ip” field. Clusters
where the LoadBalancer controller sets the
“status.loadBalancer.ingress[].ip” field are unaffected.
Kube-proxy en Windows puede reenviar tráfico involuntariamente a procesos locales que escuchan en el mismo puerto (“spec.ports[*].port”) que LoadBalancer Service cuando el controlador LoadBalancer no configura “status.loadBalancer.ingress[].ip”. Los clústeres donde el controlador LoadBalancer establece el campo "status.loadBalancer.ingress[].ip" no se ven afectados.
A flaw was found in the Windows kube-proxy component. In a cloud environment that does not set the “.status.loadBalancer.ingress.ip” field in the LoadBalancer service status configuration (for example in AWS) the packets can be misrouted and reach an unintended destination.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-21 CVE Reserved
- 2021-06-23 CVE Published
- 2023-12-22 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/kubernetes/kubernetes/pull/99958 | Third Party Advisory | |
| https://groups.google.com/g/kubernetes-security-announce/c/lIoOPObO51Q/m/O15LOazPAgAJ | Mailing List | |
| https://security.netapp.com/advisory/ntap-20231221-0003 |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-25736 | 2021-06-23 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1946538 | 2021-06-23 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.18.0 < 1.18.18 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.18.0 < 1.18.18" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.19.0 < 1.19.10 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.19.0 < 1.19.10" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.20.0 < 1.20.6 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.20.0 < 1.20.6" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|