Input validation error in Kubernetes - CVE-2023-3955

Vulnerability identifier: #VU80008

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-3955

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on Windows nodes.

The vulnerability exists due to improper input validation. A remote user with ability to create pods on Windows nodes can obtain administrative privileges on these nodes.

Kubernetes
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Watson AIOps
IBM Netezza for Cloud Pak for Data
Windows Container Support for Red Hat OpenShift
OpenShift Container Platform for Windows Containers
Anolis OS
Fedora
kubernetes
kubernetes-client
kubernetes-kubeadm
kubernetes-master
kubernetes-node
Cloud Pak for Data

Install updates from vendor's website.

Kubernetes - addressed in versions 1.24.17, 1.25.13, 1.26.8, 1.27.5, 1.28.1
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
Windows Container Support for Red Hat OpenShift - addressed in versions 5.1.2, 6.0.2, 7.1.1, 8.0.2
kubernetes - addressed in versions 1.26.8-1.fc38, 1.27.5-1.fc39
kubernetes - update to 1.27.2-3
kubernetes-client - update to 1.27.2-3
kubernetes-kubeadm - update to 1.27.2-3
kubernetes-master - update to 1.27.2-3
kubernetes-node - update to 1.27.2-3
IBM Cloud Pak for Watson AIOps - update to 4.8.1
Cloud Pak for Data - update to 4.8.5
OpenShift Container Platform for Windows Containers - update to 9.0.0
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3

• https://seclists.org/oss-sec/2023/q3/126
• https://github.com/kubernetes/kubernetes/issues/119595

• Multiple vulnerabilities in Kubernetes
• Fedora 39 update for kubernetes
• Fedora 38 update for kubernetes
• Multiple vulnerabilities in Red Hat OpenShift support for Windows Containers 6.0
• Multiple vulnerabilities in Red Hat OpenShift support for Windows Containers 7.1
• Multiple vulnerabilities in Red Hat OpenShift support for Windows Containers 5.1
• Multiple vulnerabilities in Red Hat OpenShift support for Windows Containers 8.0
• Multiple vulnerabilities in Red Hat OpenShift for Windows Containers 9.0
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Anolis OS update for kubernetes
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data