Protection Mechanism Failure in Kubernetes - CVE-2021-25736
Published: June 23, 2021
Vulnerability identifier: #VU54339
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2021-25736
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures in the Windows kube-proxy component. In a cloud environment that does not set the “.status.loadBalancer.ingress.ip” field in the LoadBalancer service status configuration (for example in AWS) the packets can be misrouted and reach an unintended destination. An attacker can bypass implemented security restrictions and perform MitM attack.
Affected software
Kubernetes
Astronomer with IBM
IBM Cloud Pak for Watson AIOps
Windows Container Support for Red Hat OpenShift
Astronomer with IBM
IBM Cloud Pak for Watson AIOps
Windows Container Support for Red Hat OpenShift
How to mitigate CVE-2021-25736
Install updates from vendor's website.
Kubernetes - addressed in versions 1.18.18, 1.19.10, 1.20.6
Astronomer with IBM - update to 1.0.1
Windows Container Support for Red Hat OpenShift - update to 2.0.1
IBM Cloud Pak for Watson AIOps - update to 4.8.1
Astronomer with IBM - update to 1.0.1
Windows Container Support for Red Hat OpenShift - update to 2.0.1
IBM Cloud Pak for Watson AIOps - update to 4.8.1