CVE-2023-1943: Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode

[cjcullen]

Issue Details

A security issue was reported in kOps with the GCP Provider running in Gossip Mode, where Node service account credentials could be used by a container running in the cluster to retrieve sensitive information from the state storage bucket and escalate to cluster-admin permissions.

This issue has been rated High (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and assigned CVE-2023-1943.

Affected Components and Configurations

This bug affects the kOps GCP provider, only when running in Gossip Mode. See below for information about other providers.

Affected Versions

• v1.26.0 - v1.26.1
• <v1.25.4

Fixed Versions

• v1.26.2
• V1.25.4

Recent kOps improvements have systematically reduced the potential for this class of attacks, by reducing or eliminating cloud credentials/privileges on the nodes. The recommended versions vary by cloud:

AWS users: should not be affected in recent versions. kOps version 1.26 (or later) is recommended, but not a critical update.
GCE users: recommended kOps version is 1.26.3 (or later).
DigitalOcean users: recommended kOps version is 1.27.0-alpha.2 (or later), with --dns=none for new clusters. Cloud credentials have been removed from the nodes in this configuration. Future versions will likely make dns=none the default.
Hetzner users: recommended kOps version is 1.27.0-alpha.2 (or later). Cloud credentials have been removed from the nodes in this configuration.

(Azure, Scaleway and other cloud providers are following the same approach, but as these are in alpha we recommend using the latest kOps version, and generally do not recommend production usage when in alpha).

Detection

If you find evidence that this vulnerability has been exploited, please contact [email protected]

Additional Details

See kOps Issue #15539 for more details.

Acknowledgements

This vulnerability was reported by James Cleverley-Prance

Thank You,
CJ Cullen on behalf of the Kubernetes Security Response Committee

[mkoepke-xion]

@cjcullen The way I read this: If I run with kOps 1.26.2+, then even if I use gossip mode, I am not vulnerable. Is that correct?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.