CVE-2023-3955
Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
A security issue was discovered in Kubernetes where a user
that can create pods on Windows nodes may be able to escalate to admin
privileges on those nodes. Kubernetes clusters are only affected if they
include Windows nodes.
Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows.
A vulnerability was found in Kubernetes. This flaw allows a user who can create pods on Windows nodes to escalate to admin privileges on those nodes.
*Credits:
James Sturtevant, Mark Rossetti
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-07-26 CVE Reserved
- 2023-08-29 CVE Published
- 2024-10-15 CVE Updated
- 2024-10-15 First Exploit
- 2024-11-06 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-269: Improper Privilege Management
CAPEC
- CAPEC-233: Privilege Escalation
References (5)
| URL | Tag | Source |
|---|---|---|
| https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E | Mailing List | |
| https://security.netapp.com/advisory/ntap-20231221-0002 |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/kubernetes/kubernetes/issues/119595 | 2024-10-15 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-3955 | 2023-11-27 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2227128 | 2023-11-27 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | < 1.24.17 Search vendor "Kubernetes" for product "Kubernetes" and version " < 1.24.17" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.25.0 < 1.25.13 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.25.0 < 1.25.13" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.26.0 < 1.26.8 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.26.0 < 1.26.8" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.27.0 < 1.27.5 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.27.0 < 1.27.5" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Kubernetes Search vendor "Kubernetes" | Kubernetes Search vendor "Kubernetes" for product "Kubernetes" | >= 1.28.0 < 1.28.1 Search vendor "Kubernetes" for product "Kubernetes" and version " >= 1.28.0 < 1.28.1" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|