CVE-2023-2431 — Improper Validation of Specified Type of Input in Kubernetes

CWE-1287 — Improper Validation of Specified Type of Input8 documents6 sources
Severity
5.5MEDIUMNVD
CNA3.4
EPSS
0.0%
top 98.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
KubernetesK8s.io KubernetesFedoraproject Fedora
Timeline
PublishedJun 16
Latest updateAug 20

Description

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶Gok8s.io/kubernetes1.25.0 — 1.25.10+3
▶CVEListV5kubernetes/kubernetesv1.25.0 — v1.25.9+3
▶NVDkubernetes/kubernetes1.25.0 — 1.25.10+3
▶Debiankubernetes/kubernetes< 1.20.5+really1.20.2-1+3

Also affects: Fedora 38

🔴Vulnerability Details

5
OSV
Kubelet vulnerable to bypass of seccomp profile enforcement in k8s.io/kubernetes↗2024-08-20
▶
GHSA
Kubelet vulnerable to bypass of seccomp profile enforcement↗2023-06-16
▶
CVEList
Bypass of seccomp profile enforcement↗2023-06-16
▶
OSV
CVE-2023-2431: A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement↗2023-06-16
▶
OSV
Kubelet vulnerable to bypass of seccomp profile enforcement↗2023-06-16
▶

📋Vendor Advisories

2
Red Hat
kubernetes: Bypass of seccomp profile enforcement↗2023-06-16
▶
Debian
CVE-2023-2431: kubernetes - A security issue was discovered in Kubelet that allows pods to bypass the seccom...↗2023
▶
CVE-2023-2431 — Kubernetes vulnerability | cvebase