Help Center/ Cloud Container Engine/ Product Bulletin/ Vulnerability Notices/ Notice on the Kubernetes kubelet and kube-proxy Authorization Vulnerability (CVE-2020-8558)

Updated on 2023-08-02 GMT+08:00

View PDF

Notice on the Kubernetes kubelet and kube-proxy Authorization Vulnerability (CVE-2020-8558)

Description

Kubernetes officially released a security notice that the core component kube-proxy has a host boundary bypass vulnerability (CVE-2020-8558). With this vulnerability, attackers, through containers in the same LAN, can reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace, to obtain interface information. If a service on the port requires no additional authentication, the service is vulnerable to attacks. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this security vulnerability, the TCP service may be accessed by other hosts in the same LAN as the node or by containers running on the same node as the service. If the TCP service on port 1234 did not require additional authentication (because it assumed that only other localhost processes could reach it), the service could be vulnerable to attacks that use this security vulnerability.

Therefore, we kindly remind kube-proxy users to arrange self-check and implement timely security hardening.

For details, see https://github.com/kubernetes/kubernetes/issues/92315.

**Table 1** Vulnerability information
Type	CVE-ID	Severity	Discovered
Code injection	CVE-2020-8558	High	2020-07-08

Impact

If an attacker can configure the host network or runs containers with CAP_NET_RAW, the attacker can obtain the socket information of the service that listens on 127.0.0.1 on the target host. If the target host runs an exposed service that can be accessed from 127.0.0.1 without any further authentication, the service information can be obtained by the attacker. For details, see Placeholder issue.

Possible attackers can be:

Other pods sharing a host in the same switch
Running container of the local host

The following kube-proxy versions are affected by this vulnerability:

kube-proxy v1.18.0 to v1.18.3
kube-proxy v1.17.0 to v1.17.6
kube-proxy < v1.16.10

The CCE cluster control plane is protected by security groups, and CCE clusters can be accessed from tenant nodes or adjacent nodes through secure ports.

System components on cluster nodes listen on the port mapping to 127.0.0.1. This port is only used for health check and monitoring information query, which will not cause information leakage.

In conclusion, this vulnerability has little impact on CCE clusters.

Solution

Secure versions have been provided with this vulnerability fixed. If your service version falls into the affected range, upgrade it to a secure version. For details, see the official documentation:

kubelet/kube-proxy v1.18.4+
kubelet/kube-proxy v1.17.7+
kubelet/kube-proxy v1.16.11+

You are advised to take the following security measures:

If your service container needs to use the host network mode and listen on an insecure port, you can manually add an iptables rule on nodes.
Run the following command to configure an iptables rule in clusters to reject traffic to 127.0.0.1 which does not originate on the nodes.
```
 iptables -I INPUT --dst 127.0.0.0/8 ! --src 127.0.0.0/8 -m conntrack ! --ctstate RELATED,ESTABLISHED,DNAT -j DROP
```
If your cluster needs not to enable the API Server insecure port, add the --insecure-port=0 flag to your Kubernetes API Server command line to disable the insecure port.
If your cluster runs an untrusted container, run the following command to disable CAP_NET_RAW in the manifest file:
```
securityContext:
      capabilities:
        drop: ["NET_RAW"]
```