Security restrictions bypass in Kubernetes - CVE-2021-25741

Vulnerability identifier: #VU56902

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-25741

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to application does not properly impose security restrictions by allowing hostPath-like access without use of the hostPath feature. A remote user can create a container with subpath volume mounts to access files and directories outside of the volume, including on the host filesystem.

Kubernetes
cri-o (Red Hat package)
python-sushy (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
skuba
skuba-update
kubernetes-common
kubernetes-client
kubernetes-kubeadm
kubernetes-kubelet
kubernetes-1.18-kubelet
kubernetes-1.18-kubeadm
caasp-release
release-notes-caasp
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Container Platform
SUSE CaaS Platform
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Watson AIOps
IBM Sterling Order Management

Install updates from vendor's website.

Kubernetes - addressed in versions 1.19.15, 1.20.11, 1.21.5, 1.22.2
cri-o (Red Hat package) - addressed in versions 1.19.4-2.rhaos4.6.gitea37eea.el7, 1.19.4-2.rhaos4.6.gitea37eea.el8
Red Hat Advanced Cluster Management for Kubernetes - update to 2.3.3
python-sushy (Red Hat package) - update to 3.7.3-0.20210804111215.b76050c.el8
Red Hat OpenShift Container Platform - addressed in versions 3.11.524, 4.6.46, 4.7.32, 4.8.13
atomic-openshift (Red Hat package) - update to 3.11.524-1.git.0.2dffce7.el7
openshift-ansible (Red Hat package) - update to 3.11.524-1.git.0.150f8a9.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.524-1.git.99b2acf.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.524-1.git.13de638.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.524-1.git.39cfc66.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.524-1.git.f8bf728.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.524-1.git.c8f26da.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.524-1.git.f2f435d.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.524-1.git.56ad978.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.524-1.git.d435537.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.524-1.git.22be164.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.524-1.git.edebe84.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.524-1.git.609cd20.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.524-1.git.2e6be86.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.524-1.git.99aae51.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.524-1.git.3571208.el7
openshift-kuryr (Red Hat package) - update to 3.11.524-1.git.b234b49.el7
openshift (Red Hat package) - addressed in versions 4.6.0-202109180038.p0.git.d5ed12c.assembly.stream.el7, 4.6.0-202109180038.p0.git.d5ed12c.assembly.stream.el8, 4.7.0-202109172126.p0.git.bbbc079.assembly.stream.el7, 4.7.0-202109172126.p0.git.bbbc079.assembly.stream.el8, 4.8.0-202109180335.p0.git.a620f50.assembly.stream.el7, 4.8.0-202109180335.p0.git.a620f50.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.8.0-202109201328.p0.git.88e7eba.assembly.stream.el7, 4.8.0-202109201328.p0.git.88e7eba.assembly.stream.el8
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
skuba - addressed in versions 1.4.13-3.56.2, 2.1.15-3.15.13.2
skuba-update - addressed in versions 1.4.13-3.56.2, 2.1.15-3.15.13.2
kubernetes-common - update to 1.17.17-4.25.2
kubernetes-client - update to 1.17.17-4.25.2
kubernetes-kubeadm - update to 1.17.17-4.25.2
kubernetes-kubelet - update to 1.17.17-4.25.2
kubernetes-1.18-kubelet - update to 1.18.20-4.11.3
kubernetes-1.18-kubeadm - update to 1.18.20-4.11.3
caasp-release - addressed in versions 4.2.6-24.43.2, 4.5.5-1.19.3
release-notes-caasp - addressed in versions 4.2.20210929-4.71.2, 4.5.20210907-3.22.3
IBM Cloud Pak for Watson AIOps - update to 4.8.1
IBM Sterling Order Management - update to 10.0.0.29

• Exploit #7250 - CVE-2021-25741 (Exploit for CVE-2021-25741 vulnerability) (January 19, 2022)

• https://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s
• https://github.com/kubernetes/kubernetes/issues/104980

• Security restrictions bypass in Kubernetes
• OpenShift Container Platform 4.8 update for Kubernetes
• Security restrictions bypass in Red Hat OpenShift Container Platform 4.6
• Red Hat OpenShift Container Platform 4.7 update for Kubernetes
• Security restrictions bypass in OpenShift Container Platform 3.11
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• SUSE update for Includes a kubernetes update to 1.18.20 including a backport for CVE-2021-25741
• SUSE update for Includes a kubernetes update to 1.17.17 including a backport for CVE-2021-25741
• Security restrictions bypass in IBM Sterling Order Management
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data