Quantum Secular Labs / Blog / Advisories

CVE-2018-1002105: In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to…

CVE-2018-1002105 is rated critical with a CVSS v3.0 base score of 9.8 and affects Kubernetes, along with 2 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.

Severity breakdown

CVSS v3.0 9.8: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Affected products

  • Kubernetes: from 1.0.0 up to and including 1.9.11; from 1.10.0 up to and including 1.10.10; from 1.11.0 up to and including 1.11.4; from 1.12.0 up to and including 1.12.2; 1.9.12 beta0
  • Red Hat Openshift Container Platform: 3.2; 3.3; 3.4; 3.5; 3.6; 3.8; 3.10; 3.11
  • Netapp Trident: all versions listed by NVD

References