Time-of-check Time-of-use (TOCTOU) Race Condition in Kubernetes - CVE-2020-8562

Vulnerability details

The vulnerability allows a remote privileged user to gain access to potentially sensitive information.

The vulnerability exists due to a time-of-check time-of-use (TOCTOU) race condition flaw in the API Server proxy. A remote privileged user can send a specially-crafted request and exploit this vulnerability to gain access to private networks on the Kubernetes control plane components.

Affected software

How to mitigate CVE-2020-8562

External References

• https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY
• https://github.com/kubernetes/kubernetes/issues/101493
• https://security.netapp.com/advisory/ntap-20220225-0002/

Related Security Bulletins

• Time-of-check time-of-use (TOCTOU) race condition in Kubernetes
• Multiple vulnerabilities in IBM InfoSphere Information Server