Security restrictions bypass in Kubernetes - CVE-2021-25741

Vulnerability identifier: #VU56902

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green

CVE-ID: CVE-2021-25741

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Affected software:
Kubernetes
cri-o (Red Hat package)
python-sushy (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
skuba
skuba-update
kubernetes-common
kubernetes-client
kubernetes-kubeadm
kubernetes-kubelet
kubernetes-1.18-kubelet
kubernetes-1.18-kubeadm
caasp-release
release-notes-caasp
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Container Platform
SUSE CaaS Platform
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Watson AIOps
IBM Sterling Order Management

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to application does not properly impose security restrictions by allowing hostPath-like access without use of the hostPath feature. A remote user can create a container with subpath volume mounts to access files and directories outside of the volume, including on the host filesystem.

Install updates from vendor's website.

• https://groups.google.com/g/kubernetes-security-announce/c/nyfdhK24H7s
• https://github.com/kubernetes/kubernetes/issues/104980