GHSA-qjvc-p88j-j9rm

Suggest an improvement
Source
https://github.com/advisories/GHSA-qjvc-p88j-j9rm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-qjvc-p88j-j9rm/GHSA-qjvc-p88j-j9rm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qjvc-p88j-j9rm
Aliases
Published
2024-10-29T14:44:36Z
Modified
2024-10-30T21:57:10.684677Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Kyverno's PolicyException objects can be created in any namespace by default
Details

Summary

A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace.

Details

By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions.

PoC

  1. Administrator creates "disallow-privileged-containers" ClusterPolicy that applies to resources in the namespace "ubuntu-restricted"
  2. Cluster user creates a PolicyException object for "disallow-privileged-containers" in namespace "ubuntu-restricted"
  3. Cluster user creates a pod with a privileged container in "ubuntu-restricted"
  4. Cluster user escalates to root on the node from the privileged container

Impact

Administrators attempting to enforce cluster security through kyverno policies, but that allow less privileged users to create resources

References

Affected packages

Go / github.com/kyverno/kyverno

Package

Name
github.com/kyverno/kyverno
View open source insights on deps.dev
Purl
pkg:golang/github.com/kyverno/kyverno

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.13.0