CVE-2020-8569: NULL Pointer Dereference in Kubernetes CSI snapshot-controller
Summary
CVE-2020-8569: NULL Pointer Dereference in Kubernetes CSI snapshot-controller. Affects github.com/kubernetes-csi/external-snapshotter/v2 versions >= 2.0.0, < 2.1.3. Fixed in 2.1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kubernetes CSI snapshot-controller is responsible for managing volume snapshots in Kubernetes. It allows users to take snapshots of their volumes and perform operations such as deleting snapshots. The snapshot-controller is a critical component for data protection and disaster recovery in Kubernetes clusters.
Vulnerability Detail
The vulnerability in the Kubernetes CSI snapshot-controller occurs when processing a VolumeSnapshot custom resource. Specifically, when a VolumeSnapshot references a non-existing PersistentVolumeClaim and does not reference any VolumeSnapshotClass, the snapshot-controller can panic and crash. This vulnerability affects the volume snapshot feature, preventing users from taking snapshots of their volumes or deleting existing snapshots. Other Kubernetes functionality is not affected.
How To Fix
Minimum fixed version
2.1.3
This is the first release that contains the fix.
go get github.com/kubernetes-csi/external-snapshotter/v2@v2.1.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to upgrade to the fixed version of the Kubernetes CSI snapshot-controller.
Conclusion
The vulnerability in the Kubernetes CSI snapshot-controller can lead to a NULL pointer dereference and subsequent crashes when processing VolumeSnapshot custom resources. This affects the volume snapshot feature, preventing users from taking snapshots of their volumes or deleting existing snapshots. To fix the vulnerability, users should upgrade to the latest version of the Kubernetes CSI snapshot-controller. It is recommended to use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. For further support, contact DevNack.com.
See every vulnerability recorded for github.com/kubernetes-csi/external-snapshotter/v2 →
FAQ
The vulnerability prevents users from taking snapshots of their volumes or deleting existing snapshots. However, it does not affect other Kubernetes functionality.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, including the Kubernetes CSI snapshot-controller vulnerability.
There are no known exploits for this vulnerability at the time of this report. However, it is recommended to upgrade to the fixed version to mitigate any potential risks.
Yes, this vulnerability only affects the volume snapshot feature of Kubernetes. All other functionality remains unaffected.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in fixing the vulnerability.
