Resource exhaustion in Kubernetes - CVE-2020-8557

Vulnerability identifier: #VU34052

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8557

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.

Kubernetes
jenkins (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
Red Hat OpenShift Container Platform

Install update from vendor's website.

Kubernetes - update to 1.18.6
jenkins (Red Hat package) - addressed in versions 2.235.2.1597312414-1.el7, 2.235.5.1600415514-1.el7
Red Hat OpenShift Container Platform - update to 3.11.542
atomic-openshift (Red Hat package) - update to 3.11.542-1.git.0.f2fd300.el7
openshift-ansible (Red Hat package) - update to 3.11.542-1.git.0.ee1d12e.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.542-1.git.99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.542-1.git.13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.542-1.git.39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.542-1.git.f8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.542-1.git.c8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.542-1.git.f2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.542-1.git.06f1612.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.542-1.git.d435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.542-1.git.22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.542-1.git.edebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.542-1.git.609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.542-1.git.2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.542-1.git.99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.542-1.git.3571208.el7
openshift-kuryr (Red Hat package) - update to 3.11.542-1.git.707a557.el7
openshift (Red Hat package) - addressed in versions 4.3.37-202009120213.p0.git.0.dffefe4.el8, 4.4.0-202008250319.p0.git.0.d653415.el7, 4.4.0-202008250319.p0.git.0.d653415.el8, 4.5.0-202008130146.p0.git.0.aaf1d57.el7, 4.5.0-202008130146.p0.git.0.aaf1d57.el8

• https://github.com/kubernetes/kubernetes/issues/93032
• https://groups.google.com/g/kubernetes-security-announce/c/cB_JUsYEKyY/m/vVSO61AhBwAJ

• Resource exhaustion in Kubernetes
• Red Hat OpenShift Container Platform 4.5.7 update for jenkins and openshift
• Red Hat OpenShift Container Platform 3.11 update for kubernetes
• Red Hat OpenShift Container Platform 4.4 update for openshift
• Red Hat OpenShift Container Platform 4.3 update for jenkins and openshift