SB2023062858 - Privilege escalation in Kubelet
Published: June 28, 2023
Security Bulletin ID
SB2023062858
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-2431)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode
Remediation
Install update from vendor's website.