Skip to content

Commit 004aa43

Browse files
tatianabgopherbot
tatianab
authored and
gopherbot
committed
data/reports: review GO-2023-2170 and GO-2023-2330
User-requested review. - data/reports/GO-2023-2170.yaml - data/reports/GO-2023-2330.yaml Updates #2170 Updates #2330 Fixes #3322 Change-Id: I1eec81f034263c43dd2938d84c366df9fc9a0bb1 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/635706 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Tatiana Bradley <[email protected]> Reviewed-by: Zvonimir Pavlinovic <[email protected]>
1 parent ec8e9cf commit 004aa43

File tree

4 files changed

+136
-24
lines changed

4 files changed

+136
-24
lines changed

‎data/osv/GO-2023-2170.json

+73-8
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
"CVE-2023-3955",
88
"GHSA-q78c-gwqw-jcmc"
99
],
10-
"summary": "Kubernetes privilege escalation vulnerability in k8s.io/kubernetes",
11-
"details": "Kubernetes privilege escalation vulnerability in k8s.io/kubernetes",
10+
"summary": "Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes and k8s.io/mount-utils",
11+
"details": "A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.",
1212
"affected": [
1313
{
1414
"package": {
@@ -52,18 +52,83 @@
5252
]
5353
}
5454
],
55-
"ecosystem_specific": {}
55+
"ecosystem_specific": {
56+
"imports": [
57+
{
58+
"path": "k8s.io/kubernetes/pkg/volume/util",
59+
"goos": [
60+
"windows"
61+
],
62+
"symbols": [
63+
"WriteVolumeCache"
64+
]
65+
}
66+
]
67+
}
68+
},
69+
{
70+
"package": {
71+
"name": "k8s.io/mount-utils",
72+
"ecosystem": "Go"
73+
},
74+
"ranges": [
75+
{
76+
"type": "SEMVER",
77+
"events": [
78+
{
79+
"introduced": "0"
80+
},
81+
{
82+
"fixed": "0.24.17"
83+
},
84+
{
85+
"introduced": "0.25.0"
86+
},
87+
{
88+
"fixed": "0.25.13"
89+
},
90+
{
91+
"introduced": "0.26.0"
92+
},
93+
{
94+
"fixed": "0.26.8"
95+
},
96+
{
97+
"introduced": "0.27.0"
98+
},
99+
{
100+
"fixed": "0.27.5"
101+
},
102+
{
103+
"introduced": "0.28.0"
104+
},
105+
{
106+
"fixed": "0.28.1"
107+
}
108+
]
109+
}
110+
],
111+
"ecosystem_specific": {
112+
"imports": [
113+
{
114+
"path": "k8s.io/mount-utils",
115+
"goos": [
116+
"windows"
117+
],
118+
"symbols": [
119+
"SafeFormatAndMount.formatAndMountSensitive",
120+
"listVolumesOnDisk"
121+
]
122+
}
123+
]
124+
}
56125
}
57126
],
58127
"references": [
59128
{
60129
"type": "ADVISORY",
61130
"url": "https://github.com/advisories/GHSA-q78c-gwqw-jcmc"
62131
},
63-
{
64-
"type": "ADVISORY",
65-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3955"
66-
},
67132
{
68133
"type": "WEB",
69134
"url": "https://github.com/kubernetes/kubernetes/commit/38c97fa67ed35f36e730856728c9e3807f63546a"
@@ -119,6 +184,6 @@
119184
],
120185
"database_specific": {
121186
"url": "https://pkg.go.dev/vuln/GO-2023-2170",
122-
"review_status": "UNREVIEWED"
187+
"review_status": "REVIEWED"
123188
}
124189
}

‎data/osv/GO-2023-2330.json

+17-8
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@
77
"CVE-2023-3676",
88
"GHSA-7fxm-f474-hf8w"
99
],
10-
"summary": "Kubernetes privilege escalation vulnerability in k8s.io/kubernetes",
11-
"details": "Kubernetes privilege escalation vulnerability in k8s.io/kubernetes",
10+
"summary": "Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes",
11+
"details": "A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.",
1212
"affected": [
1313
{
1414
"package": {
@@ -52,18 +52,27 @@
5252
]
5353
}
5454
],
55-
"ecosystem_specific": {}
55+
"ecosystem_specific": {
56+
"imports": [
57+
{
58+
"path": "k8s.io/kubernetes/pkg/volume/util/subpath",
59+
"goos": [
60+
"windows"
61+
],
62+
"symbols": [
63+
"evalSymlink",
64+
"getUpperPath"
65+
]
66+
}
67+
]
68+
}
5669
}
5770
],
5871
"references": [
5972
{
6073
"type": "ADVISORY",
6174
"url": "https://github.com/advisories/GHSA-7fxm-f474-hf8w"
6275
},
63-
{
64-
"type": "ADVISORY",
65-
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3676"
66-
},
6776
{
6877
"type": "WEB",
6978
"url": "https://github.com/kubernetes/kubernetes/commit/073f9ea33a93ddaecdc2e829150fb715f6387399"
@@ -123,6 +132,6 @@
123132
],
124133
"database_specific": {
125134
"url": "https://pkg.go.dev/vuln/GO-2023-2330",
126-
"review_status": "UNREVIEWED"
135+
"review_status": "REVIEWED"
127136
}
128137
}

‎data/reports/GO-2023-2170.yaml

+32-4
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,42 @@ modules:
1212
- introduced: 1.28.0
1313
- fixed: 1.28.1
1414
vulnerable_at: 1.28.0
15-
summary: Kubernetes privilege escalation vulnerability in k8s.io/kubernetes
15+
packages:
16+
- package: k8s.io/kubernetes/pkg/volume/util
17+
goos:
18+
- windows
19+
symbols:
20+
- WriteVolumeCache
21+
- module: k8s.io/mount-utils
22+
versions:
23+
- fixed: 0.24.17
24+
- introduced: 0.25.0
25+
- fixed: 0.25.13
26+
- introduced: 0.26.0
27+
- fixed: 0.26.8
28+
- introduced: 0.27.0
29+
- fixed: 0.27.5
30+
- introduced: 0.28.0
31+
- fixed: 0.28.1
32+
vulnerable_at: 0.28.0
33+
packages:
34+
- package: k8s.io/mount-utils
35+
goos:
36+
- windows
37+
symbols:
38+
- SafeFormatAndMount.formatAndMountSensitive
39+
- listVolumesOnDisk
40+
summary: Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes and k8s.io/mount-utils
41+
description: |-
42+
A security issue was discovered in Kubernetes where a user that can create pods
43+
on Windows nodes may be able to escalate to admin privileges on those nodes.
44+
Kubernetes clusters are only affected if they include Windows nodes.
1645
cves:
1746
- CVE-2023-3955
1847
ghsas:
1948
- GHSA-q78c-gwqw-jcmc
2049
references:
2150
- advisory: https://github.com/advisories/GHSA-q78c-gwqw-jcmc
22-
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-3955
2351
- web: https://github.com/kubernetes/kubernetes/commit/38c97fa67ed35f36e730856728c9e3807f63546a
2452
- web: https://github.com/kubernetes/kubernetes/commit/50334505cd27cbe7cf71865388f25a00e29b2596
2553
- web: https://github.com/kubernetes/kubernetes/commit/7da6d72c05dffb3b87e62e2bc8c3228ea12ba1b9
@@ -35,6 +63,6 @@ references:
3563
- web: https://groups.google.com/g/kubernetes-security-announce/c/JrX4bb7d83E
3664
source:
3765
id: GHSA-q78c-gwqw-jcmc
38-
created: 2024-08-20T12:12:15.292286-04:00
39-
review_status: UNREVIEWED
66+
created: 2024-12-12T14:41:27.794119-05:00
67+
review_status: REVIEWED
4068
unexcluded: EFFECTIVELY_PRIVATE

‎data/reports/GO-2023-2330.yaml

+14-4
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,24 @@ modules:
1212
- introduced: 1.28.0
1313
- fixed: 1.28.1
1414
vulnerable_at: 1.28.0
15-
summary: Kubernetes privilege escalation vulnerability in k8s.io/kubernetes
15+
packages:
16+
- package: k8s.io/kubernetes/pkg/volume/util/subpath
17+
goos:
18+
- windows
19+
symbols:
20+
- getUpperPath
21+
- evalSymlink
22+
summary: Insufficient input sanitization on Windows nodes leads to privilege escalation in k8s.io/kubernetes
23+
description: |-
24+
A security issue was discovered in Kubernetes where a user that can create pods
25+
on Windows nodes may be able to escalate to admin privileges on those nodes.
26+
Kubernetes clusters are only affected if they include Windows nodes.
1627
cves:
1728
- CVE-2023-3676
1829
ghsas:
1930
- GHSA-7fxm-f474-hf8w
2031
references:
2132
- advisory: https://github.com/advisories/GHSA-7fxm-f474-hf8w
22-
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-3676
2333
- web: https://github.com/kubernetes/kubernetes/commit/073f9ea33a93ddaecdc2e829150fb715f6387399
2434
- web: https://github.com/kubernetes/kubernetes/commit/39cc101c7855341c651a943b9836b50fbace8a6b
2535
- web: https://github.com/kubernetes/kubernetes/commit/74b617310c24ca84c2ec90c3858af745d65b5226
@@ -36,6 +46,6 @@ references:
3646
- web: https://security.netapp.com/advisory/ntap-20231130-0007
3747
source:
3848
id: GHSA-7fxm-f474-hf8w
39-
created: 2024-08-20T12:14:41.740115-04:00
40-
review_status: UNREVIEWED
49+
created: 2024-12-12T15:03:43.614919-05:00
50+
review_status: REVIEWED
4151
unexcluded: EFFECTIVELY_PRIVATE

0 commit comments

Comments
 (0)