Kubernetes node disk Denial of Service by writing to container /etc/hosts

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• kubernetes kubernetesbefore 1.16.13
• kubernetes kubernetes1.17.0 and later · before 1.17.9
• kubernetes kubernetes1.18.0 and later · before 1.18.6

Versions reported by the vendor

Affected version ranges reported by the assigning authority (kubernetes). Independent of NVD's CPE analysis and usually ahead of it.

• Kubernetes Kubernetes

  • 1.15, 1.14, 1.13, 1.12, 1.11, 1.10, 1.9, 1.8, 1.7, 1.6, 1.5, 1.4 … (+3)affected
  • 1.18 and later · before 1.18.6affected
  • 1.17 and later · before 1.17.9affected
  • 1.16 and later · before 1.16.13affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2018-1002105In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the
  65This week
• CVE-2019-11248Kubernetes kubelet exposes /debug/pprof info on healthz port
  55Plan
• CVE-2017-1002101In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with
  42Plan
• CVE-2018-1002101In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Wi
  40Plan
• CVE-2017-1000056Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to
  40Plan
• CVE-2016-1906Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.