<div dir="ltr">Hello Kubernetes Community,<br>
<br>
A security issue was discovered in Kubernetes where an unauthorized user<br>
may be able to ssh to a node VM which uses a VM image built with the<br>
Kubernetes Image Builder project (<br>
<a href="https://github.com/kubernetes-sigs/image-builder" rel="noreferrer" target="_blank">https://github.com/kubernetes-sigs/image-builder</a>).<br>
<br>
For images built with the Proxmox provider, this issue has been rated<br>
Critical (<br>
<a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" rel="noreferrer" target="_blank">https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</a>)<br>
(9.8), and assigned CVE-2024-9486.<br>
<br>
For images built with the Nutanix, OVA, QEMU or raw providers, this issue<br>
has been rated Medium (<br>
<a href="https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" rel="noreferrer" target="_blank">https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H</a>)<br>
(6.3), and assigned CVE-2024-9594.<br>
<br>
Am I vulnerable?<br>
<br>
Clusters using virtual machine images built with Kubernetes Image Builder (<br>
<a href="https://github.com/kubernetes-sigs/image-builder" rel="noreferrer" target="_blank">https://github.com/kubernetes-sigs/image-builder</a>) version v0.1.37 or<br>
earlier are affected.<br>
<br>
CVE-2024-9486: VMs using images built with the Proxmox provider are<br>
confirmed to be vulnerable.<br>
<br>
CVE-2024-9594: VMs using images built with the Nutanix, OVA, QEMU or raw<br>
providers were vulnerable during the build process and are affected only if<br>
an attacker was able to reach the VM where the image build was happening<br>
and used the vulnerability to modify the image at the time the image build<br>
was occurring.<br>
<br>
VMs using images built with all other providers are not affected.<br>
<br>
To determine the version of Image Builder you are using, use one of the<br>
following methods:<br>
<br>
* For git clones of the image builder repository:<br>
cd <local path to image builder repo><br>
<br>
make version<br>
<br>
* For installations using a tarball download:<br>
cd <local path to install location><br>
<br>
grep -o v0\\.[0-9.]* RELEASE.md | head -1<br>
<br>
* For a container image release:<br>
<br>
docker run --rm <image pull spec> version<br>
or<br>
podman run --rm <image pull spec> version<br>
<br>
or look at the image tag specified, in the case of an official image such<br>
as<br>
<a href="http://registry.k8s.io/scl-image-builder/cluster-node-image-builder-amd64:v0.1.37" rel="noreferrer" target="_blank">registry.k8s.io/scl-image-builder/cluster-node-image-builder-amd64:v0.1.37</a><br>
<br>
How do I mitigate this vulnerability?<br>
<br>
Rebuild any affected images using a fixed version of Image Builder.<br>
Re-deploy the fixed images to any affected VMs.<br>
<br>
Prior to upgrading, this vulnerability can be mitigated by disabling the<br>
builder account on affected VMs:<br>
<br>
usermod -L builder<br>
<br>
Fixed Versions<br>
<br>
Kubernetes Image Builder versions >= v0.1.38<br>
<br>
Detection<br>
<br>
The linux command "last builder" can be used to view logins to the affected<br>
"builder" account.<br>
<br>
If you find evidence that this vulnerability has been exploited, please<br>
contact <a href="mailto:security@kubernetes.io" target="_blank">security@kubernetes.io</a><br>
<br>
Additional Details<br>
<br>
See the GitHub issues for more details:<br>
<br>
<a href="https://github.com/kubernetes/kubernetes/issues/128006" rel="noreferrer" target="_blank">https://github.com/kubernetes/kubernetes/issues/128006</a><br>
<br>
<a href="https://github.com/kubernetes/kubernetes/issues/128007" rel="noreferrer" target="_blank">https://github.com/kubernetes/kubernetes/issues/128007</a><br>
<br>
Acknowledgements<br>
<br>
This vulnerability was reported by Nicolai Rybnikar @rybnico from Rybnikar<br>
Enterprises GmbH.<br>
<br>
The issue was fixed and coordinated by Marcus Noble of the Image Builder<br>
project.<br>
<br>
Thank You,<br>
<br>
Joel Smith on behalf of the Kubernetes Security Response Committee<div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>===</div><div>Computer Security Incident Response Team - CSIRT</div><div>Universidade Estadual de Campinas - Unicamp</div><div>Centro de Computacao - CCUEC</div><div>GnuPG Public Key: <a href="http://www.security.unicamp.br/security.asc" target="_blank">http://www.security.unicamp.br/security.asc</a> [^]</div><div>Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830</div></div></div></div></div>