Permissions, Privileges, and Access Controls in apiserver - CVE-2023-1260

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU78481

Permissions, Privileges, and Access Controls in apiserver - CVE-2023-1260

Published: July 21, 2023


Vulnerability identifier: #VU78481
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-1260
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to improper access restrictions within kube-apiserver. A remote authenticated user with "update, patch" permissions to the "pods/ephemeralcontainers" subresource can bypass SCC admission restrictions and gain control over a privileged pod.


Affected software

apiserver
Red Hat OpenShift Container Platform
containernetworking-plugins (Red Hat package)
cri-o (Red Hat package)
nmstate (Red Hat package)
container-selinux (Red Hat package)
openvswitch3.1 (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
openshift-ansible (Red Hat package)
openshift4-aws-iso (Red Hat package)
openshift-kuryr (Red Hat package)
microshift (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
openstack-ironic (Red Hat package)
ovn23.06 (Red Hat package)

How to mitigate CVE-2023-1260

Install updates from vendor's website.

Red Hat OpenShift Container Platform - addressed in versions 4.10.67, 4.11.46, 4.12.24, 4.13.5, 4.13.6
containernetworking-plugins (Red Hat package) - update to 1.0.1-8.rhaos4.13.el8
cri-o (Red Hat package) - addressed in versions 1.24.6-4.rhaos4.11.git4bfe15a.el8, 1.26.3-10.rhaos4.13.git78941bf.el8, 1.26.3-11.rhaos4.13.git78941bf.el9
nmstate (Red Hat package) - update to 2.2.12-1.rhaos4.13.el8
container-selinux (Red Hat package) - update to 2.215.0-1.rhaos4.13.el8
openvswitch3.1 (Red Hat package) - update to 3.1.0-32.el9fdp
openshift (Red Hat package) - addressed in versions 4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el7, 4.10.0-202308291228.p0.g26fdcdf.assembly.stream.el8, 4.11.0-202307200925.p0.ga9da4a8.assembly.stream.el8, 4.12.0-202307040929.p0.g1485cc9.assembly.stream.el8, 4.12.0-202307040929.p0.g1485cc9.assembly.stream.el9, 4.13.0-202307132344.p0.gf245ced.assembly.stream.el8, 4.13.0-202307132344.p0.gf245ced.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.11.0-202307200522.p0.g7e1b2fb.assembly.stream.el8, 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el8, 4.13.0-202306230038.p0.ge4c9a6a.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.13.0-202306230038.p0.g148be47.assembly.stream.el8, 4.13.0-202306230038.p0.g148be47.assembly.stream.el9
openshift4-aws-iso (Red Hat package) - update to 4.13.0-202306230038.p0.gd2acdd5.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.13.0-202306281017.p0.g5baee73.assembly.stream.el8
microshift (Red Hat package) - update to 4.14.0-202310261440.p0.g1586504.assembly.4.14.0.el9
kernel (Red Hat package) - addressed in versions 4.18.0-305.103.1.el8_4, 5.14.0-284.23.1.el9_2
kernel-rt (Red Hat package) - addressed in versions 4.18.0-305.103.1.rt7.178.el8_4, 5.14.0-284.23.1.rt14.308.el9_2
openstack-ironic (Red Hat package) - update to 21.3.1-0.20230706125653.c8f8157.el9
ovn23.06 (Red Hat package) - update to 23.06.0-13.el9fdp

External References

Related Security Bulletins