Permissions, Privileges, and Access Controls in apiserver - CVE-2023-2728

Vulnerability identifier: #VU77526

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-2728

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to improperly imposed security restrictions. A remote user can launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers.

Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with ephemeral containers.

apiserver
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Containers Module
openSUSE Leap
openEuler
IBM Concert Software
IBM API Connect
Business Automation Insights
IBM Cloud Pak for Watson AIOps
kubernetes1.18-client
kubernetes1.18-client-common
kubernetes1.18-client-debuginfo
kubernetes-kubelet
kubernetes-help
kubernetes-node
kubernetes-master
kubernetes-client
kubernetes
kubernetes-kubeadm
kubernetes1.23-client-debuginfo
kubernetes1.23-client
kubernetes1.23-client-common
kubernetes1.23-apiserver-debuginfo
kubernetes1.23-apiserver
kubernetes1.23-scheduler
kubernetes1.23-kubelet-common
kubernetes1.23-proxy
kubernetes1.23-controller-manager
kubernetes1.23-kubeadm
kubernetes1.23-kubelet
kubernetes1.23-client-bash-completion
kubernetes1.23-client-fish-completion
kubernetes1.23-kubeadm-debuginfo
kubernetes1.23-kubelet-debuginfo
kubernetes1.23-scheduler-debuginfo
kubernetes1.23-controller-manager-debuginfo
kubernetes1.23-proxy-debuginfo
kubernetes1.24-client
kubernetes1.24-kubelet-common
kubernetes1.24-scheduler
kubernetes1.24-kubeadm
kubernetes1.24-client-common
kubernetes1.24-controller-manager
kubernetes1.24-apiserver
kubernetes1.24-kubelet
kubernetes1.24-proxy
kubernetes1.24-client-bash-completion
kubernetes1.24-client-fish-completion
microshift (Red Hat package)
Cloud Pak for Data

Install updates from vendor's website.

apiserver - addressed in versions 1.24.15, 1.25.11, 1.26.6, 1.27.3
IBM Concert Software - update to 1.1.0
IBM API Connect - update to 10.0.8.5
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
kubernetes1.18-client - update to 1.18.10-150200.5.10.1
kubernetes1.18-client-common - update to 1.18.10-150200.5.10.1
kubernetes1.18-client-debuginfo - update to 1.18.10-150200.5.10.1
kubernetes-kubelet - update to 1.20.2-20
kubernetes-help - update to 1.20.2-20
kubernetes-node - update to 1.20.2-20
kubernetes-master - update to 1.20.2-20
kubernetes-client - update to 1.20.2-20
kubernetes - update to 1.20.2-20
kubernetes-kubeadm - update to 1.20.2-20
kubernetes1.23-client-debuginfo - addressed in versions 1.23.17-150300.7.9.1, 1.23.17-150500.3.3.1
kubernetes1.23-client - addressed in versions 1.23.17-150300.7.9.1, 1.23.17-150500.3.3.1
kubernetes1.23-client-common - addressed in versions 1.23.17-150300.7.9.1, 1.23.17-150500.3.3.1
kubernetes1.23-apiserver-debuginfo - update to 1.23.17-150500.3.3.1
kubernetes1.23-apiserver - update to 1.23.17-150500.3.3.1
kubernetes1.23-scheduler - update to 1.23.17-150500.3.3.1
kubernetes1.23-kubelet-common - update to 1.23.17-150500.3.3.1
kubernetes1.23-proxy - update to 1.23.17-150500.3.3.1
kubernetes1.23-controller-manager - update to 1.23.17-150500.3.3.1
kubernetes1.23-kubeadm - update to 1.23.17-150500.3.3.1
kubernetes1.23-kubelet - update to 1.23.17-150500.3.3.1
kubernetes1.23-client-bash-completion - update to 1.23.17-150500.3.3.1
kubernetes1.23-client-fish-completion - update to 1.23.17-150500.3.3.1
kubernetes1.23-kubeadm-debuginfo - update to 1.23.17-150500.3.3.1
kubernetes1.23-kubelet-debuginfo - update to 1.23.17-150500.3.3.1
kubernetes1.23-scheduler-debuginfo - update to 1.23.17-150500.3.3.1
kubernetes1.23-controller-manager-debuginfo - update to 1.23.17-150500.3.3.1
kubernetes1.23-proxy-debuginfo - update to 1.23.17-150500.3.3.1
kubernetes1.24-client - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-kubelet-common - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-scheduler - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-kubeadm - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-client-common - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-controller-manager - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-apiserver - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-kubelet - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-proxy - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-client-bash-completion - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
kubernetes1.24-client-fish-completion - addressed in versions 1.24.13-150500.3.3.1, 1.24.16-150400.9.8.2, 1.24.17-150300.7.6.1, 1.24.17-150400.9.16.1
IBM Cloud Pak for Watson AIOps - update to 4.8.1
Cloud Pak for Data - update to 4.8.5
microshift (Red Hat package) - update to 4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9

• Exploit #10497 - Metasploit-Module-TFM (Module written in Ruby with the objective of exploiting vulnerabilities CVE-2023-2728 and CVE-2024-3177, both related to the secret mount policy in a Kubernetes cluster using a custom Metasploit module. Part of a Cybersecurity Mast (September 6, 2024)

• https://groups.google.com/a/kubernetes.io/g/dev/c/_Xx3ZrNeZYg/m/cjBUC0IxAAAJ

• Multiple vulnerabilities in Kubernetes apiserver
• SUSE update for kubernetes1.24
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.18
• SUSE update for kubernetes1.24
• Multiple vulnerabilities in Red Hat build of MicroShift
• openEuler 20.03 LTS SP3 update for kubernetes
• openEuler 22.03 LTS update for kubernetes
• openEuler 22.03 LTS SP1 update for kubernetes
• openEuler 22.03 LTS SP2 update for kubernetes
• Multiple vulnerabilities in IBM Cloud Pak for Data
• SUSE update for kubernetes1.23
• SUSE update for kubernetes1.24
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM API Connect
• Multiple vulnerabilities in IBM Business Automation Insights