GitHub Advisoryadvisory · Go

GHSA-r76g-g87f-vw8f Kubelet Incorrect Privilege Assignment

MEDIUM Published 2024-04-24 Modified 2024-06-10 Official page ↗
Aliases
CVE-2019-11245
Ecosystem
Go
Packages
k8s.io/kubernetes/cmd/kubelet
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-266, CWE-703
Reviewed
2024-04-24

Affected packages

• Go k8s.io/kubernetes/cmd/kubelet: >= 1.14.0, < 1.14.3 → fixed in 1.14.3 • Go k8s.io/kubernetes/cmd/kubelet: >= 1.13.0, < 1.13.7 → fixed in 1.13.7

Description

In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit `runAsUser` attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified `mustRunAsNonRoot: true`, the kubelet will refuse to start the container as root. If the pod did not specify `mustRunAsNonRoot: true`, the kubelet will run the container as uid 0.

Related

Alias · CVE (1)

  • CVE-2019-11245 In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container… vulnerability

Weakness · CWE (2)

  • CWE-266 Incorrect Privilege Assignment weakness
  • CWE-703 Improper Check or Handling of Exceptional Conditions weakness

References