GitHub Advisoryadvisory · Go

GHSA-xc8m-28vv-4pjc Kubelet vulnerable to bypass of seccomp profile enforcement

MEDIUM Published 2023-06-16 Modified 2024-12-12 Official page ↗
Aliases
CVE-2023-2431
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1287
Reviewed
2023-06-16

Affected packages

• Go k8s.io/kubernetes: < 1.24.14 → fixed in 1.24.14 • Go k8s.io/kubernetes: >= 1.25.0, < 1.25.10 → fixed in 1.25.10 • Go k8s.io/kubernetes: >= 1.26.0, < 1.26.5 → fixed in 1.26.5 • Go k8s.io/kubernetes: >= 1.27.0, < 1.27.2 → fixed in 1.27.2

Description

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

Related

Alias · CVE (1)

  • CVE-2023-2431 A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. vulnerability

Weakness · CWE (1)

  • CWE-1287 Improper Validation of Specified Type of Input weakness

References