CVE-2022-31078
KubeEdge CloudCore Router memory exhaustion
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made by the REST handler. An attacker could use this weakness to make a request that will return an HTTP response with a large body and cause DoS of CloudCore. In the HTTP Handler API, the rest handler makes a request to a pre-specified handle. The handle will return an HTTP response that is then read into memory. The consequence of the exhaustion is that CloudCore will be in a denial of service. Only an authenticated user of the cloud can make an attack. It will be affected only when users enable `router` module in the config file `cloudcore.yaml`. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable the router switch in the config file `cloudcore.yaml`.
KubeEdge es un sistema de código abierto para extender las capacidades de orquestación de aplicaciones nativas en contenedores a los hosts en Edge. En versiones anteriores a 1.11.1, 1.10.2 y 1.9.4, el enrutador CloudCore no impone un límite al tamaño de las respuestas a las peticiones realizadas por el manejador REST. Un atacante podría usar esta debilidad para hacer una petición que devuelva una respuesta HTTP con un cuerpo grande y causar DoS de CloudCore. En la API del manejador HTTP, el manejador de descanso hace una petición a un manejador preestablecido. El manejador devolverá una respuesta HTTP que luego es leída en la memoria. La consecuencia del agotamiento es que CloudCore será encontrado en una situación de denegación de servicio. Sólo un usuario autenticado de la nube puede realizar un ataque. Sólo está afectado cuando los usuarios habiliten el módulo "router" en el archivo de configuración "cloudcore.yaml". Este error ha sido corregido en Kubeedge versiones 1.11.1, 1.10.2 y 1.9.4. Como mitigación, deshabilite el interruptor del enrutador en el archivo de configuración "cloudcore.yaml"
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-18 CVE Reserved
- 2022-07-11 CVE Published
- 2024-02-01 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (1)
| URL | Tag | Source |
|---|---|---|
| https://github.com/kubeedge/kubeedge/security/advisories/GHSA-qpx3-9565-5xwm | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linuxfoundation Search vendor "Linuxfoundation" | Kubeedge Search vendor "Linuxfoundation" for product "Kubeedge" | < 1.9.4 Search vendor "Linuxfoundation" for product "Kubeedge" and version " < 1.9.4" | - |
Affected
| ||||||
| Linuxfoundation Search vendor "Linuxfoundation" | Kubeedge Search vendor "Linuxfoundation" for product "Kubeedge" | >= 1.10.0 < 1.10.2 Search vendor "Linuxfoundation" for product "Kubeedge" and version " >= 1.10.0 < 1.10.2" | - |
Affected
| ||||||
| Linuxfoundation Search vendor "Linuxfoundation" | Kubeedge Search vendor "Linuxfoundation" for product "Kubeedge" | >= 1.11.0 < 1.11.1 Search vendor "Linuxfoundation" for product "Kubeedge" and version " >= 1.11.0 < 1.11.1" | - |
Affected
| ||||||