CVE-2019-11244: Incorrect Permission Assignment for Critical Resource and Use of Cache Containing Sensitive Information in Kubernetes
Summary
CVE-2019-11244: Kubernetes Unsafe Cacheing. Affects k8s.io/client-go versions >= 1.8.0, < 1.12.9. Fixed in 1.12.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is 'github.com/kubernetes/client-go/discovery/cached/disk', which is a Go package used in Kubernetes. It is responsible for caching schema information used by the 'kubectl' command-line tool. The schema info is cached in a directory specified by the '--cache-dir' flag, with the default location being '$HOME/.kube/http-cache'. The cached files are written with world-writeable permissions (rw-rw-rw-), which can lead to potential security issues.
Vulnerability Detail
The vulnerability in Kubernetes versions 1.8.x to 1.14.x arises from the incorrect permission assignment for the cached files. If the '--cache-dir' flag is set to a different location accessible to other users or groups, the cached files can be modified by unauthorized entities. This can disrupt the 'kubectl' invocation and potentially lead to unauthorized access or data manipulation.
How To Fix
Minimum fixed version
1.12.9
This is the first release that contains the fix.
go get k8s.io/client-go@v1.12.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a workaround is to manually adjust the permissions of the cache directory to restrict write access for other users or groups. This can be done using the 'chmod' command in the terminal. For example, 'chmod 700 /path/to/cache-dir' will set the directory permissions to read, write, and execute for the owner only.
Conclusion
In conclusion, the vulnerability in Kubernetes versions 1.8.x to 1.14.x allows unauthorized modification of cached files due to incorrect permission assignment. Upgrading to Kubernetes version 1.12.9 or later is recommended to fix this issue. Alternatively, manually adjusting the permissions of the cache directory can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for k8s.io/client-go →
FAQ
The vulnerability can allow unauthorized modification of the cached files, potentially leading to disruption of 'kubectl' invocations and unauthorized access or data manipulation.
Kubernetes versions 1.8.x to 1.14.x are affected by this vulnerability.
Yes, upgrading to Kubernetes version 1.12.9 or later includes the necessary fixes.
Yes, you can manually adjust the permissions of the cache directory to restrict write access for other users or groups.
There are no known exploits for this vulnerability at the moment.
References
Related vulnerabilities
Recent vulnerabilities recorded for k8s.io/client-go.
