CVE-2023-3676
Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.
Se descubrió un problema de seguridad en Kubernetes donde un usuario que pueda crear pods en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows.
A vulnerability was found in Kubernetes. This flaw allows a user who can create pods on Windows nodes to escalate to admin privileges on those nodes.
The components for Red Hat OpenShift for Windows Containers 9.0.0 are now available. This product release includes bug fixes and security updates for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Issues addressed include a privilege escalation vulnerability.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2023-07-14 CVE Reserved
- 2023-08-29 CVE Published
- 2025-02-27 CVE Updated
- 2025-02-27 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-269: Improper Privilege Management
CAPEC
- CAPEC-233: Privilege Escalation
References (5)
| URL | Tag | Source |
|---|---|---|
| https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc | Mailing List | |
| https://security.netapp.com/advisory/ntap-20231130-0007 |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/kubernetes/kubernetes/issues/119339 | 2025-02-27 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-3676 | 2023-11-27 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2227126 | 2023-11-27 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | < 1.24.17 Search vendor "Kubernetes" for product "Kubernetes" and version " < 1.24.17" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.25.0 < 1.25.13 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.25.0 < 1.25.13" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.26.0 < 1.26.8 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.26.0 < 1.26.8" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.27.0 < 1.27.5 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.27.0 < 1.27.5" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.28.0 < 1.28.1 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.28.0 < 1.28.1" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|