All security bulletins for the following products are described in this page:
- Google Kubernetes Engine (GKE)
- Anthos clusters on VMware (GKE on-prem)
- Anthos clusters on AWS (GKE on AWS)
- Anthos on Azure
- Anthos clusters on bare metal
Vulnerabilities are often kept secret under embargo until affected parties have had a chance to address them. In these cases, the product's release notes will refer to "security updates" until the embargo has been lifted. At that point the notes will be updated to reflect the vulnerability the patch addressed.
When GKE issues a security bulletin that directly correlates to
your cluster configuration or version, we might send you a SecurityBulletinEvent
cluster notification that provides information about the vulnerability and actions
that you can take, if applicable. For information about setting up cluster
notifications, refer to Cluster notifications.
For more information on how Google manages security vulnerabilities and patches for GKE and Anthos, see Security patching.
GKE and Anthos platforms don't use components
such as ingress-nginx
and the CRI-O container runtime, and are unaffected
by any vulnerabilities in those components. If you install components from
other sources, refer to the security updates and patching advice of those
components at the source.
Use this XML feed to subscribe to security bulletins for this page.
GCP-2023-005
Published: 2023-05-18
Reference: CVE-2023-1281, CVE-2023-1829
GKE
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2023-1281, CVE-2023-1829) have been discovered in the Linux kernel that can lead to a privilege escalation to root on the node. GKE Standard clusters are affected. GKE Autopilot clusters and clusters using GKE Sandbox are not affected. What should I do?The following versions of GKE have been updated with code to fix this vulnerability. For security purposes, even if you have node auto-upgrade enabled, we recommend that you manually upgrade your cluster and node pools to one of the following GKE versions:
A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you secure your nodes until the new version becomes the default for your release specific channel. What vulnerabilities are addressed by this patch?Both CVE-2023-1281 and CVE-2023-1829 are use-after-free vulnerabilities in the Linux Kernel traffic control index filter (tcindex) that can be exploited to achieve local privilege escalation. With CVE-2023-1829, the tcindex_delete function does not properly deactivate filters in certain cases which can later lead to double freeing of a data structure. In CVE-2023-1281, the imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when |
High |
Anthos clusters on VMware
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2023-1281, CVE-2023-1829) have been discovered in the Linux kernel that can lead to a privilege escalation to root on the node. What should I do?What vulnerabilities are addressed by this patch?Both CVE-2023-1281 and CVE-2023-1829 are use-after-free vulnerabilities in the Linux Kernel traffic traffic control index filter (tcindex) that can be exploited to achieve local privilege escalation. With CVE-2023-1829, the tcindex_delete function does not properly deactivate filters in certain cases which can later lead to double freeing of a data structure. In CVE-2023-1281, the imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when |
High |
Anthos clusters on AWS
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2023-1281, CVE-2023-1829) have been discovered in the Linux kernel that can lead to a privilege escalation to root on the node. What should I do?What vulnerabilities are addressed by this patch?Both CVE-2023-1281 and CVE-2023-1829 are use-after-free vulnerabilities in the Linux Kernel traffic traffic control index filter (tcindex) that can be exploited to achieve local privilege escalation. With CVE-2023-1829, the tcindex_delete function does not properly deactivate filters in certain cases which can later lead to double freeing of a data structure. In CVE-2023-1281, the imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when |
High |
Anthos on Azure
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2023-1281, CVE-2023-1829) have been discovered in the Linux kernel that can lead to a privilege escalation to root on the node. What should I do?What vulnerabilities are addressed by this patch?Both CVE-2023-1281 and CVE-2023-1829 are use-after-free vulnerabilities in the Linux Kernel traffic traffic control index filter (tcindex) that can be exploited to achieve local privilege escalation. With CVE-2023-1829, the tcindex_delete function does not properly deactivate filters in certain cases which can later lead to double freeing of a data structure. In CVE-2023-1281, the imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when |
High |
Anthos clusters on bare metal
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2023-1281, CVE-2023-1829) have been discovered in the Linux kernel that can lead to a privilege escalation to root on the node. Anthos clusters on bare metal are not affected by this CVE. What should I do?No action required. |
None |
GCP-2023-003
Published: 2023-04-11
Reference: CVE-2023-0240,
CVE-2023-23586
GKE
Description | Severity |
---|---|
Two new vulnerabilities, CVE-2023-0240 and CVE-2023-23586, have been discovered in the Linux kernel that could allow an unprivileged user to escalate privileges. GKE clusters, including Autopilot clusters, with COS using Linux Kernel version 5.10 until 5.10.162 are affected. GKE clusters using Ubuntu images or using GKE Sandbox are unaffected. What should I do?The following versions of GKE have been updated with code to fix these vulnerabilities. For security purposes, even if you have node-autoupgrade enabled, we recommend that you manually upgrade your node pools to one of the following GKE versions:
A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you secure your nodes until the new version becomes the default for your release specific channel. What vulnerabilities are addressed by this patch?Vulnerability 1 (CVE-2023-0240): A race condition in Vulnerability 2 (CVE-2023-23586): A use after free (UAF) in |
High |
Anthos clusters on VMware
Description | Severity |
---|---|
Two new vulnerabilities, CVE-2023-0240 and CVE-2023-23586, have been discovered in the Linux kernel that could allow an unprivileged user to escalate privileges. Anthos clusters on VMware clusters with COS using Linux Kernel version 5.10 until 5.10.162 are affected. Anthos clusters using Ubuntu images are unaffected. What should I do?The following versions of Anthos clusters on VMware have been updated with code to fix these vulnerabilities:
What vulnerabilities are addressed by this patch?Vulnerability 1 (CVE-2023-0240): A race condition in Vulnerability 2 (CVE-2023-23586): A use after free (UAF) in |
High |
Anthos clusters on AWS
Description | Severity |
---|---|
Two new vulnerabilities, CVE-2023-0240 and CVE-2023-23586, have been discovered in the Linux kernel that could allow an unprivileged user to escalate privileges. Anthos clusters on AWS is not affected by these CVEs. What should I do?No action required. |
None |
Anthos on Azure
Description | Severity |
---|---|
Two new vulnerabilities, CVE-2023-0240 and CVE-2023-23586, have been discovered in the Linux kernel that could allow an unprivileged user to escalate privileges. Anthos on Azure is not affected by these CVEs What should I do?No action required. |
None |
Anthos clusters on bare metal
Description | Severity |
---|---|
Two new vulnerabilities, CVE-2023-0240 and CVE-2023-23586, have been discovered in the Linux kernel that could allow an unprivileged user to escalate privileges. Anthos clusters on bare metal is not affected by these CVEs. What should I do?No action required. |
None |
GCP-2023-001
Published: 2023-03-01
Reference: CVE-2022-4696
GKE
Description | Severity |
---|---|
A new vulnerability (CVE-2022-4696) has been discovered in the Linux kernel that can lead to a privilege escalation on the node. GKE clusters, including Autopilot clusters, are impacted. GKE clusters using GKE Sandbox are not affected. What should I do?The following versions of GKE have been updated with code to fix this vulnerability. For security purposes, even if you have node auto-upgrade enabled, we recommend that you manually upgrade your clusters and node pools to one of the following GKE versions:
A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you secure your nodes until the new version becomes the default for your release specific channel. What vulnerabilities are addressed by this patch?With CVE-2022-4696, a use-after-free flaw was found in io_uring and ioring_op_splice in the Linux kernel. This flaw allows a local user to create a local privilege escalation. |
High |
Anthos clusters on VMware
Description | Severity |
---|---|
A new vulnerability (CVE-2022-4696) has been discovered in the Linux kernel that can lead to a privilege escalation on the node. Anthos clusters on VMware running v1.12 and v1.13 are impacted. Anthos clusters on VMware running v1.14 or later are not affected. What should I do?The following versions of Anthos clusters on VMware have been updated with code to fix this vulnerability. We recommend that you upgrade your admin and user clusters to one of the following Anthos clusters on VMware versions:
What vulnerabilities are addressed by this patch?With CVE-2022-4696, a use-after-free flaw was found in io_uring and ioring_op_splice in the Linux kernel. This flaw allows a local user to create a local privilege escalation. |
High |
Anthos clusters on AWS
Description | Severity |
---|---|
A new vulnerability (CVE-2022-4696) has been discovered in the Linux kernel that can lead to a privilege escalation on the node. Anthos clusters on AWS is unaffected by this vulnerability. What should I do?No action is required. |
None |
Anthos on Azure
Description | Severity |
---|---|
A new vulnerability (CVE-2022-4696) has been discovered in the Linux kernel that can lead to a privilege escalation on the node. Anthos on Azure is unaffected by this vulnerability. What should I do?No action is required. |
None |
Anthos clusters on bare metal
Description | Severity |
---|---|
A new vulnerability (CVE-2022-4696) has been discovered in the Linux kernel that can lead to a privilege escalation on the node. Anthos clusters on bare metal is unaffected by this vulnerability. What should I do?No action is required. |
None |
GCP-2022-026
Published: 2023-01-11
Reference: CVE-2022-3786, CVE-2022-3602
GKE
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-3786 and CVE-2022-3602) have been discovered in OpenSSL v3.0.6 that can potentially cause a crash. While this has been rated a High in the NVD database, GKE endpoints use boringSSL or an older version of OpenSSL that is not affected, so the rating has been reduced to a Medium for GKE. What should I do?The following versions of GKE have been updated with code to fix this vulnerability:
A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you secure your nodes until the new version becomes the default for your release specific channel. What vulnerabilities are addressed by this patch?With CVE-2022-3786 and CVE-2022-3602, a buffer overrun can be triggered in X.509 certificate verification that can cause a crash that will result in a denial of service. To be exploited, this vulnerability requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. |
Medium |
Anthos clusters on VMware
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-3786 and CVE-2022-3602) have been discovered in OpenSSL v3.0.6 that can potentially cause a crash. What should I do?Anthos clusters on VMware is not affected by this CVE as it does not use an impacted version of OpenSSL. What vulnerabilities are addressed by this patch?No action required. |
None |
Anthos clusters on AWS
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-3786 and CVE-2022-3602) have been discovered in OpenSSL v3.0.6 that can potentially cause a crash. What should I do?Anthos clusters on AWS is not affected by this CVE as it does not use an impacted version of OpenSSL. What vulnerabilities are addressed by this patch?No action required. |
None |
Anthos on Azure
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-3786 and CVE-2022-3602) have been discovered in OpenSSL v3.0.6 that can potentially cause a crash. What should I do?Anthos on Azure is not affected by this CVE as it does not use an impacted version of OpenSSL. What vulnerabilities are addressed by this patch?No action required. |
None |
Anthos clusters on bare metal
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-3786 and CVE-2022-3602) have been discovered in OpenSSL v3.0.6 that can potentially cause a crash. What should I do?Anthos clusters on bare metal is not affected by this CVE as it does not use an impacted version of OpenSSL. What vulnerabilities are addressed by this patch?No action required. |
None |
GCP-2022-025
Published: 2022-12-21
Updated: 2023-01-19
Reference: CVE-2022-2602
2023-01-19 Update: GKE version 1.21.14-gke.14100 is available.
GKE
Updated: 2023-01-19
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2602) has been discovered in the io_uring subsystem in the Linux kernel that can allow an attacker to potentially execute arbitrary code. GKE clusters, including Autopilot clusters, are impacted. GKE clusters using GKE Sandbox are not affected. What should I do?2023-01-19 Update: Version 1.21.14-gke.14100 is available. Upgrade your node pools to this version or later. The following versions of GKE have been updated with code to fix this vulnerability in an upcoming release. For security purposes, even if you have node auto-upgrade enabled, we recommend that you manually upgrade your node pools to one of the following GKE versions:
A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you secure your nodes until the new version becomes the default for your release specific channel. What vulnerabilities are addressed by this patch?With CVE-2022-2602, a race condition between io_uring request processing and Unix socket garbage collection can cause a use-after-free vulnerability. A local attacker could use this to trigger a denial of service or possibly execute arbitrary code. |
High |
Anthos clusters on VMware
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2602) has been discovered in the io_uring subsystem in the Linux kernel that can allow an attacker to potentially execute arbitrary code. Versions 1.11, 1.12 and 1.13 of Anthos clusters on VMware are affected. What should I do?Upgrade your cluster to a patched version. The following versions of Anthos clusters on VMware contain code that fixes this vulnerability:
What vulnerabilities are addressed by this patch?With CVE-2022-2602, a race condition between io_uring request processing and Unix socket garbage collection can cause a use-after-free vulnerability. A local attacker could use this to trigger a denial of service or possibly execute arbitrary code. |
High |
Anthos clusters on AWS
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2602) has been discovered in the io_uring subsystem in the Linux kernel that can allow an attacker to potentially execute arbitrary code. What should I do?The following current and previous generation versions of Anthos clusters on AWS have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos clusters on AWS versions:
What vulnerabilities are addressed by this patch?With CVE-2022-2602, a race condition between io_uring request processing and Unix socket garbage collection can cause a use-after-free vulnerability. A local attacker could use this to trigger a denial of service or possibly execute arbitrary code. |
High |
Anthos on Azure
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2602) has been discovered in the io_uring subsystem in the Linux kernel that can allow an attacker to potentially execute arbitrary code. What should I do?The following versions of Anthos on Azure have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos on Azure versions:
What vulnerabilities are addressed by this patch?With CVE-2022-2602, a race condition between io_uring request processing and Unix socket garbage collection can cause a use-after-free vulnerability. A local attacker could use this to trigger a denial of service or possibly execute arbitrary code. |
High |
Anthos clusters on bare metal
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2602) has been discovered in the io_uring subsystem in the Linux kernel that can allow an attacker to potentially execute arbitrary code. Anthos clusters on bare metal is not affected by this CVE as it does not bundle an operating system in its distribution. What should I do?No action required. |
None |
GCP-2022-024
Published: 2022-11-09
Updated: 2023-01-19
Reference: CVE-2022-2585, CVE-2022-2588
2023-01-19 Update: GKE version 1.21.14-gke.14100 is available. 2022-12-16 Update: Added revised patch versions for GKE and Anthos clusters on VMware.
GKE
Updated: 2023-01-19
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-2585 and CVE-2022-2588) have been discovered in the Linux kernel that can lead to a full container break out to root on the node. GKE clusters, including Autopilot clusters, are impacted. GKE clusters using GKE Sandbox are not affected. What should I do?2023-01-19 Update: Version 1.21.14-gke.14100 is available. Upgrade your node pools to this version or later. 2022-12-16 Update: A previous version of the bulletin has been revised due to a release regression. Please manually upgrade your node pools to one of the following GKE versions:
The following versions of GKE have been updated with code to fix this vulnerability. For security purposes, even if you have node-autoupgrade enabled, we recommend that you manually upgrade your node pools to one of the following GKE versions:
Updates for GKE v1.22, 1.23 and 1.25 will be made available soon. This security bulletin will be updated when they become available. A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you secure your nodes until the new version becomes the default for your release specific channel. What vulnerabilities are addressed by this patch?
|
High |
Anthos clusters on VMware
Updated: 2022-12-16
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-2585 and CVE-2022-2588) have been discovered in the Linux kernel that can lead to a full container break out to root on the node. Versions 1.13, 1.12 and 1.11 of Anthos clusters on VMware are affected. What should I do?2022-12-16 Update: The following versions of Anthos clusters on VMware have been updated with code to fix this vulnerability. We recommend that you upgrade your admin and user clusters to one of the following Anthos clusters on VMware versions:
What vulnerabilities are addressed by this patch?
|
High |
Anthos clusters on AWS
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-2585 and CVE-2022-2588) have been discovered in the Linux kernel that can lead to a full container break out to root on the node. The following versions of Kubernetes on AWS may be affected:
Kubernetes V1.24 is not affected. What should I do?We recommend that you upgrade your clusters to one of the following AWS Kubernetes versions:
What vulnerabilities are being addressed?With CVE-2022-2585, improper cleanup of timers in the posix cpu timer allows a use-after-free exploit depending on how timers are created and deleted. With CVE-2022-2588, a use-after-free flaw was found in route4_change in the Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege escalation. |
High |
Anthos on Azure
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-2585 and CVE-2022-2588) have been discovered in the Linux kernel that can lead to a full container break out to root on the node. The following versions of Kubernetes on Azure may be affected:
Kubernetes V1.24 is not affected. What should I do?We recommend that you upgrade your clusters to one of the following Azure Kubernetes versions:
What vulnerabilities are being addressed?With CVE-2022-2585, improper cleanup of timers in the posix cpu timer allows a use-after-free exploit depending on how timers are created and deleted. With CVE-2022-2588, a use-after-free flaw was found in route4_change in the Linux kernel. This flaw allows a local user to crash the system and possibly lead to a local privilege escalation. |
High |
Anthos clusters on bare metal
Description | Severity |
---|---|
Two new vulnerabilities (CVE-2022-2585 and CVE-2022-2588) have been discovered in the Linux kernel that can lead to a full container break out to root on the node. Anthos clusters on bare metal is not affected by this CVE as it does not bundle an operating system in its distribution. What should I do?No action required. |
None |
GCP-2022-023
Published: 2022-11-04
Reference: CVE-2022-39278
GKE
Description | Severity |
---|---|
A security vulnerability, CVE-2022-39278, has been discovered in Istio, which is used in Anthos Service Mesh, that allows a malicious attacker to crash the control plane. What should I do?Google Kubernetes Engine (GKE) doesn't ship with Istio and isn't affected by this vulnerability. However, if you have separately installed Anthos Service Mesh or Istio on your GKE cluster, refer to GCP-2022-020, the Anthos Service Mesh security bulletin on this CVE, for more information. |
None |
Anthos clusters on VMware
Description | Severity |
---|---|
A security vulnerability, CVE-2022-39278, has been discovered in Istio, which is used in Anthos Service Mesh in Anthos clusters on VMware, that allows a malicious attacker to crash the Istio control plane. What should I do?The following versions of Anthos clusters on VMware have been updated with code to fix this vulnerability. We recommend that you upgrade your admin and user clusters to one of the following Anthos clusters on VMware versions:
What vulnerabilities are addressed by this patch?
With vulnerability CVE-2022-39278, the Istio control plane, |
High |
Anthos clusters on AWS
Description | Severity |
---|---|
A security vulnerability, CVE-2022-39278, has been discovered in Istio, which is used in Anthos Service Mesh, that allows a malicious attacker to crash the control plane. What should I do?Anthos clusters on AWS isn't affected by this vulnerability and no action is required. |
None |
Anthos on Azure
Description | Severity |
---|---|
A security vulnerability, CVE-2022-39278, has been discovered in Istio, which is used in Anthos Service Mesh, that allows a malicious attacker to crash the control plane. What should I do?Anthos on Azure isn't affected by this vulnerability and no action is required. |
None |
Anthos clusters on bare metal
Description | Severity |
---|---|
A security vulnerability, CVE-2022-39278, has been discovered in Istio, which is used in Anthos Service Mesh in Anthos clusters on bare metal, that allows a malicious attacker to crash the Istio control plane. What should I do?The following versions of Anthos clusters on bare metal have been updated with code to fix this vulnerability. We recommend that you upgrade clusters to one of the following Anthos clusters on bare metal versions:
What vulnerabilities are addressed by this patch?
With vulnerability CVE-2022-39278, the Istio control plane, |
High |
GCP-2022-022-updated
Published: 2022-12-08
Reference: CVE-2022-20409
GKE
Updated: 2022-12-14
Description | Severity |
---|---|
A new vulnerability, CVE-2022-20409, has been discovered in the Linux kernel that can lead to local privilege escalation. Google Kubernetes Engine (GKE) v1.22, v1.23, and v1.24 clusters, including Autopilot clusters, using Container-Optimized OS version 93 and 97 are impacted. Other supported GKE versions aren't affected. GKE clusters using GKE Sandbox are unaffected. What should I do?2022-12-14 Update: A previous version of the bulletin has been revised due to a release regression. Please manually upgrade your node pools to one of the following GKE versions:
The following versions of GKE using Container-Optimized OS version 93 and 97 have been updated with code to fix this vulnerability in an upcoming release. For security purposes, even if you have node auto-upgrades enabled, we recommend that you manually upgrade your node pools to one of the following GKE versions:
A recent feature of release channels lets you apply a patch without having to unsubscribe from a channel. This feature lets you secure your nodes until the new version becomes the default for your release-specific channel. What vulnerabilities are addressed by this patch?With CVE-2022-20409, the Linux Kernel has a vulnerability in io_identity_cow of the io_uring subsystem. There's a potential for memory corruption due to a Use-After-Free (UAF) vulnerability. A local attacker could use this memory corruption for denial of service (system crash) or possibly to execute arbitrary code. |
High |
Anthos clusters on VMware
Updated: 2022-12-14
Description | Severity |
---|---|
A new vulnerability, CVE-2022-20409, has been discovered in the Linux kernel that can lead to local privilege escalation. What should I do?2022-12-14 Update: The following versions of Anthos clusters on VMware for Ubuntu have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos clusters on VMware versions:
What vulnerabilities are addressed by this patch?With CVE-2022-20409, the Linux Kernel has a vulnerability in io_identity_cow of the io_uring subsystem. There's a potential for memory corruption due to a Use-After-Free (UAF) vulnerability. A local attacker could use this memory corruption for denial of service (system crash) or possibly to execute arbitrary code. |
High |
Anthos clusters on AWS
Description | Severity |
---|---|
A new vulnerability, CVE-2022-20409, has been discovered in the Linux kernel that could allow an unprivileged user to escalate to system execution privilege. What should I do?There's no action required. Anthos clusters on AWS doesn't use the affected versions of the Linux kernel. What vulnerabilities are addressed by this patch?With CVE-2022-20409, the Linux Kernel has a vulnerability in io_identity_cow of the io_uring subsystem. There's a potential for memory corruption due to a Use-After-Free (UAF) vulnerability. A local attacker could use this memory corruption for denial of service (system crash) or possibly to execute arbitrary code. |
None |
Anthos on Azure
Description | Severity |
---|---|
A new vulnerability, CVE-2022-20409, has been discovered in the Linux kernel that could allow an unprivileged user to escalate to system execution privilege. What should I do?There's no action required. Anthos on Azure doesn't use the affected versions of the Linux kernel. What vulnerabilities are addressed by this patch?With CVE-2022-20409, the Linux Kernel has a vulnerability in io_identity_cow of the io_uring subsystem. There's a potential for memory corruption due to a Use-After-Free (UAF) vulnerability. A local attacker could use this memory corruption for denial of service (system crash) or possibly to execute arbitrary code. |
None |
Anthos clusters on bare metal
Description | Severity |
---|---|
A new vulnerability, CVE-2022-20409, has been discovered in the Linux kernel that can lead to local privilege escalation. What should I do?
|
None |
GCP-2022-021
Published: 2022-10-27
Updated: 2023-01-19
Reference: CVE-2022-3176
2023-01-19 Update: GKE version 1.21.14-gke.14100 is available. 2022-12-15 Update: Updated information that version 1.21.14-gke.9400 of Google Kubernetes Engine is pending rollout and may be superseded by a higher version number. 2022-11-21 Update: Added patch versions for Anthos clusters on VMware, Anthos clusters on AWS, and Anthos on Azure.
GKE
Updated: 2023-01-19
Description | Severity |
---|---|
A new vulnerability, CVE-2022-3176, has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve full container breakout to root on the node. Google Kubernetes Engine (GKE) v1.21 clusters, including Autopilot clusters, using Container-Optimized OS version 89 are impacted. Later versions of GKE aren't affected. All Linux clusters with Ubuntu are affected. GKE clusters using GKE Sandbox are unaffected. What should I do?2023-01-19 Update: Version 1.21.14-gke.14100 is available. Upgrade your node pools to this version or later. 2022-12-15 Update: Version 1.21.14-gke.9400 is pending rollout and may be superseded by a higher version number. We will update this doc when said new version is available. The following versions of GKE have been updated with code to fix this vulnerability in an upcoming release. For security purposes, even if you have node auto-upgrades enabled, we recommend that you manually upgrade your node pools to one of the following GKE versions:
A recent feature of release channels lets you apply a patch without having to unsubscribe from a channel. This feature lets you secure your nodes until the new version becomes the default for your release-specific channel. What vulnerabilities are addressed by this patch?With CVE-2022-3176, the Linux Kernel has a vulnerability in the io_uring subsystem. Missing POLLFREE handling can lead to Use-After-Free (UAF) exploits that can be used for privilege escalation. |
High |
Anthos clusters on VMware
Updated: 2022-11-21
Description | Severity |
---|---|
A new vulnerability, CVE-2022-3176, has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve full container breakout to root on the node. What should I do?
2022-11-21 Update: The following versions of Anthos clusters on VMware for Ubuntu have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos clusters on VMware versions:
Versions of Anthos clusters on VMware that contain Ubuntu patches will be released soon. This security bulletin will be updated when the Anthos clusters on VMware versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-3176, the Linux Kernel has a vulnerability in the io_uring subsystem. Missing POLLFREE handling can lead to Use-After-Free (UAF) exploits that can be used for privilege escalation. |
High |
Anthos clusters on AWS
Updated: 2022-11-21
Description | Severity |
---|---|
A new vulnerability, CVE-2022-3176, has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve full container breakout to root on the node. What should I do?2022-11-21 Update: The following current and previous generation versions of Anthos clusters on AWS have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos clusters on AWS versions: Current generation
Versions of Anthos clusters on AWS that contain Ubuntu patches will be released soon. This security bulletin will be updated when the Anthos clusters on AWS versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-3176, the Linux Kernel has a vulnerability in the io_uring subsystem. Missing POLLFREE handling can lead to Use-After-Free (UAF) exploits that can be used for privilege escalation. |
High |
Anthos on Azure
Updated: 2022-11-21
Description | Severity |
---|---|
A new vulnerability, CVE-2022-3176, has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve full container breakout to root on the node. What should I do?2022-11-21 Update: The following versions of Anthos on Azure have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos on Azure versions:
Versions of Anthos on Azure that contain Ubuntu patches will be released soon. This security bulletin will be updated when the Anthos on Azure versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-3176, the Linux Kernel has a vulnerability in the io_uring subsystem. Missing POLLFREE handling can lead to Use-After-Free (UAF) exploits that can be used for privilege escalation. |
High |
Anthos clusters on bare metal
Description | Severity |
---|---|
A new vulnerability, CVE-2022-3176, has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve full container breakout to root on the node. What should I do?No action required. Anthos clusters on bare metal isn't affected by this CVE as it doesn't bundle an operating system in its distribution. |
None |
GCP-2022-018
Published: 2022-08-01
Updated: 2022-09-14
Reference: CVE-2022-2327
2022-09-14 Update: Added patch versions for Anthos clusters on VMware, Anthos clusters on AWS, and Anthos on Azure.
GKE
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2327) has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve a full container breakout to root on the node. Technical detailsGKE clusters, including Autopilot clusters, with Container-Optimized OS (COS) using Linux Kernel version 5.10 are affected. GKE clusters using Ubuntu images or using GKE Sandbox are unaffected. What should I do?Upgrade your GKE clusters to a version that includes the fix.
The Linux node images for COS have been updated along with GKE
versions using those COS versions.
A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you upgrade your nodes to the patched version before that version becomes the default in your selected release channel. What vulnerabilities are addressed by this patch?With CVE-2022-2327, the Linux kernel in version 5.10 has a vulnerability in the io_uring subsystem where various requests are missing item types (flags). Using these requests without the proper item types specified can cause privilege escalation to root. |
High |
Anthos clusters on VMware
Updated: 2022-09-14
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2327) has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve a full container breakout to root on the node. Clusters with a Container Optimized OS (COS) image using Anthos clusters on VMware versions 1.10, 1.11, and 1.12 are affected. What should I do?2022-09-14 Update: The following versions of Anthos clusters on VMware contain code that fixes this vulnerability.
Versions of Anthos clusters on VMware that contain patches will be released soon. This security bulletin will be updated when the Anthos clusters on VMware versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-2327, the Linux kernel in version 5.10 has a vulnerability in the io_uring subsystem where various requests are missing item types (flags). Using these requests without the proper item types specified can cause privilege escalation to root. |
High |
Anthos clusters on AWS
Updated: 2022-09-14
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2327) has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve a full container breakout to root on the node. What should I do?2022-09-14 Update: The following current and previous generation versions of Anthos clusters on AWS have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos clusters on AWS versions: Current generation
Previous generation
Versions of Anthos clusters on AWS that contain patches will be released soon. This security bulletin will be updated when the Anthos clusters on AWS versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-2327, the Linux kernel in version 5.10 has a vulnerability in the io_uring subsystem where various requests are missing item types (flags). Using these requests without the proper item types specified can cause privilege escalation to root. |
High |
Anthos on Azure
Updated: 2022-09-14
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2327) has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve a full container breakout to root on the node. What should I do?2022-09-14 Update: The following versions of Anthos on Azure have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos on Azure versions:
Versions of Anthos on Azure that contain patches will be released soon. This security bulletin will be updated when the Anthos on Azure versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-2327, the Linux kernel in version 5.10 has a vulnerability in the io_uring subsystem where various requests are missing item types (flags). Using these requests without the proper item types specified can cause privilege escalation to root. |
High |
Anthos on bare metal
Description | Severity |
---|---|
A new vulnerability (CVE-2022-2327) has been discovered in the Linux kernel that can lead to local privilege escalation. This vulnerability allows an unprivileged user to achieve a full container breakout to root on the node. What should I do?There is no action required. Anthos on bare metal is not affected by this CVE as it does not bundle an operating system in its distribution. |
None |
GCP-2022-017
Published: 2022-06-29
Updated: 2022-11-22
Reference: CVE-2022-1786
2022-11-22 Update: Updated information about workloads using GKE Sandbox.
2022-07-21 Update: Updated information that Anthos clusters on VMware COS images
are affected.
GKE
Updated: 2022-11-22
Description | Severity |
---|---|
2022-11-22 update: Workloads using GKE Sandbox are not affected by these vulnerabilities. A new vulnerability (CVE-2022-1786) has been discovered in the Linux kernel versions 5.10 and 5.11. This vulnerability allows an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. Only clusters that run Container-Optimized OS are affected. GKE Ubuntu versions use either version 5.4 or 5.15 of the kernel and are not affected. What should I do?The versions of Linux node images for Container-Optimized OS for the following versions of GKE have been updated with code to fix this vulnerability. For security purposes, even if you have node-autoupgrade enabled, we recommend that you manually upgrade your node pools to one of the following upcoming GKE versions:
A recent release channels feature allows you to apply a patch without having to unsubscribe from a channel. This lets you upgrade your nodes to the patched version before that version becomes the default in your selected release channel. What vulnerabilities are addressed by this patch?With CVE-2022-1786, a use-after-free flaw was found in the Linux kernel's io_uring subsystem. If a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on the ring, a local user can crash or escalate their privileges on the system. |
High |
Anthos clusters on VMware
Updated: 2022-07-14
Description | Severity |
---|---|
A new vulnerability (CVE-2022-1786) has been discovered in the Linux kernel versions 5.10 and 5.11. This vulnerability allows an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. What should I do?2022-07-21 Update: The following versions of Anthos clusters on VMware contain code that fixes this vulnerability. COS
UbuntuThere is no action required. Anthos clusters on VMware does not use the affected versions of the Linux kernel. |
None |
Anthos clusters on AWS
Description | Severity |
---|---|
A new vulnerability (CVE-2022-1786) has been discovered in the Linux kernel versions 5.10 and 5.11. This vulnerability allows an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. What should I do?There is no action required. Anthos clusters on AWS does not use the affected versions of the Linux kernel. |
None |
Anthos on Azure
Description | Severity |
---|---|
A new vulnerability (CVE-2022-1786) has been discovered in the Linux kernel versions 5.10 and 5.11. This vulnerability allows an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. What should I do?There is no action required. Anthos on Azure does not use the affected versions of the Linux kernel. |
None |
Anthos on bare metal
Description | Severity |
---|---|
A new vulnerability (CVE-2022-1786) has been discovered in the Linux kernel versions 5.10 and 5.11. This vulnerability allows an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. What should I do?There is no action required. Anthos on bare metal is not affected by this CVE as it does not bundle an operating system in its distribution. |
None |
GCP-2022-016
Published: 2022-06-23
Updated: 2022-11-22
Reference: CVE-2022-29581, CVE-2022-29582, CVE-2022-1116
2022-11-22 Update: Added information about workloads running in Autopilot clusters.
2022-07-29 Update: Updated versions for Anthos clusters on VMware,
Anthos clusters on AWS, and Anthos on Azure.
GKE
Updated: 2022-11-22
Description | Severity |
---|---|
2022-11-22 update: Autopilot clusters are not affected by CVE-2022-29581 but are vulnerable to CVE-2022-29582 and CVE-2022-1116. 2022-07-29 update: Pods using GKE Sandbox are not vulnerable to these vulnerabilities. Three new memory corruption vulnerabilities (CVE-2022-29581, CVE-2022-29582, CVE-2022-1116) have been discovered in the Linux kernel. These vulnerabilities allow an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. All Linux clusters (Container-Optimized OS and Ubuntu) are affected. What should I do?The versions of Linux node images for both Container-Optimized OS and Ubuntu for the following versions of GKE have been updated with code to fix this vulnerability. For security purposes, even if you have node auto-upgrade enabled, we recommend that you manually upgrade your node pools to one of the following GKE versions:
A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you upgrade your nodes to the patched version before that version becomes the default in your selected release channel. What vulnerabilities are addressed by this patch?With CVE-2022-29582, the Linux kernel in versions prior to 5.17.3 has a use-after-free due to a race condition in io_uring timeouts. CVE-2022-29581 and CVE-2022-1116 are vulnerabilities where a local attacker can cause memory corruption in io_uring or net/sched in the Linux kernel to escalate privileges to root. |
High |
Anthos clusters on VMware
Updated: 2022-07-29
Description | Severity |
---|---|
2022-07-29 Update: The following versions of Anthos clusters on VMware contain code that fixes these vulnerabilities.
Three new memory corruption vulnerabilities (CVE-2022-29581, CVE-2022-29582, CVE-2022-1116) have been discovered in the Linux kernel. These vulnerabilities allow an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. These vulnerabilities affect Anthos clusters on VMware v1.9 and later for Container-Optimized OS and Ubuntu images. What should I do?Versions of Anthos clusters on VMware that contain patches will be released soon. This security bulletin will be updated when the Anthos clusters on VMware versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-29582, the Linux kernel in versions prior to 5.17.3 has a use-after-free due to a race condition in io_uring timeouts. CVE-2022-29581 and CVE-2022-1116 are vulnerabilities where a local attacker can cause memory corruption in io_uring or net/sched in the Linux kernel to escalate privileges to root. |
High |
Anthos clusters on AWS
Updated: 2022-07-29
Description | Severity |
---|---|
2022-07-29 Update: Update: The following current and previous generation versions of Anthos clusters on AWS have been updated with code to fix these vulnerabilities. We recommend that you upgrade your nodes to one of the following Anthos clusters on AWS versions: Current generation:
Three new memory corruption vulnerabilities (CVE-2022-29581, CVE-2022-29582, CVE-2022-1116) have been discovered in the Linux kernel. These vulnerabilities allow an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. These vulnerabilities affect all versions of Anthos clusters on AWS. What should I do?Versions of Anthos clusters on AWS that contain patches will be released soon. This security bulletin will be updated when the Anthos clusters on AWS versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-29582, the Linux kernel in versions prior to 5.17.3 has a use-after-free due to a race condition in io_uring timeouts. CVE-2022-29581 and CVE-2022-1116 are vulnerabilities where a local attacker can cause memory corruption in io_uring or net/sched in the Linux kernel to escalate privileges to root. |
High |
Anthos on Azure
Description | Severity |
---|---|
2022-07-29 Update: Update: The following versions of Anthos on Azure have been updated with code to fix these vulnerabilities. We recommend that you upgrade your nodes to one of the following Anthos on Azure versions:
Three new memory corruption vulnerabilities (CVE-2022-29581, CVE-2022-29582, CVE-2022-1116) have been discovered in the Linux kernel. These vulnerabilities allow an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. These vulnerabilities affect all versions of Anthos on Azure. What should I do?Versions of Anthos on Azure that contain patches will be released soon. This security bulletin will be updated when the Anthos on Azure versions are available for download. What vulnerabilities are addressed by this patch?With CVE-2022-29582, the Linux kernel in versions prior to 5.17.3 has a use-after-free due to a race condition in io_uring timeouts. CVE-2022-29581 and CVE-2022-1116 are vulnerabilities where a local attacker can cause memory corruption in io_uring or net/sched in the Linux kernel to escalate privileges to root. |
High |
Anthos on bare metal
Description | Severity |
---|---|
Three new memory corruption vulnerabilities (CVE-2022-29581, CVE-2022-29582, CVE-2022-1116) have been discovered in the Linux kernel. These vulnerabilities allow an unprivileged user with local access to the cluster to achieve a full container breakout to root on the node. What should I do?There is no action required. Anthos on bare metal is not affected by this vulnerability as it does not bundle an operating system in its distribution. |
None |
GCP-2022-014
Published: 2022-04-26
Updated: 2022-11-22
2022-11-22 Update: Added information about workloads running in Autopilot clusters.
2022-05-12 Update: Updated patch versions for Anthos clusters on AWS and
Anthos on Azure.
Reference: CVE-2022-1055, CVE-2022-27666
GKE
Updated: 2022-11-22
Description | Severity |
---|---|
2022-11-22 update: GKE Autopilot clusters and workloads running in GKE Sandbox are unaffected by these vulnerabilities. Two security vulnerabilities, CVE-2022-1055 and CVE-2022-27666 have been discovered in the Linux kernel. Each can lead to a local attacker being able to perform a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all GKE node operating systems (Container-Optimized OS and Ubuntu). Technical detailsIn CVE-2022-1055, an attacker can exploit use-after-free in tc_new_tfilter() which allows a local attacker in the container to escalate privileges to root on node. In CVE-2022-27666, buffer overflow in esp/esp6_output_head allows a local attacker in the container to escalate privileges to root on the node. What should I do?The versions of Linux node images for the following versions of GKE have been updated with code to fix these vulnerabilities. Upgrade your clusters to one of the following upcoming GKE versions:
What vulnerabilities are addressed by this patch? |
High |
Anthos clusters on VMware
Description | Severity |
---|---|
Two security vulnerabilities, CVE-2022-1055 and CVE-2022-27666 have been discovered in the Linux kernel. Each can lead to a local attacker being able to perform a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all GKE node operating systems (Container-Optimized OS and Ubuntu). Technical detailsIn CVE-2022-1055, an attacker can exploit use-after-free in tc_new_tfilter() which allows a local attacker in the container to escalate privileges to root on node. In CVE-2022-27666, buffer overflow in esp/esp6_output_head allows a local attacker in the container to escalate privileges to root on the node. What should I do?Upgrade your cluster to a patched version. The following Anthos clusters on VMware versions or newer contain the fix for this vulnerability:
What vulnerabilities are addressed by this patch? |
High |
Anthos clusters on AWS
Updated: 2022-05-12
Description | Severity |
---|---|
Two security vulnerabilities, CVE-2022-1055 and CVE-2022-27666 have been discovered in the Linux kernel. Each can lead to a local attacker being able to perform a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all GKE node operating systems (Container-Optimized OS and Ubuntu). Technical detailsIn CVE-2022-1055, an attacker can exploit use-after-free in tc_new_tfilter() which allows a local attacker in the container to escalate privileges to root on node. In CVE-2022-27666, buffer overflow in esp/esp6_output_head allows a local attacker in the container to escalate privileges to root on the node. What should I do?2022-05-12 Update: The following current and previous generation versions of Anthos clusters on AWS have been updated with code to fix these vulnerabilities. We recommend that you upgrade your nodes to one of the following Anthos clusters on AWS versions: Current generation
Upgrade your cluster to a patched version. Patches will be available in an upcoming release. This bulletin will be updated when they are available. What vulnerabilities are addressed by this patch? |
High |
Anthos on Azure
Updated: 2022-05-12
Description | Severity |
---|---|
Two security vulnerabilities, CVE-2022-1055 and CVE-2022-27666 have been discovered in the Linux kernel. Each can lead to a local attacker being able to perform a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all GKE node operating systems (Container-Optimized OS and Ubuntu). Technical detailsIn CVE-2022-1055, an attacker can exploit use-after-free in tc_new_tfilter() which allows a local attacker in the container to escalate privileges to root on node. In CVE-2022-27666, buffer overflow in esp/esp6_output_head allows a local attacker in the container to escalate privileges to root on the node. What should I do?2022-05-12 Update: The following versions of Anthos on Azure have been updated with code to fix these vulnerabilities. We recommend that you upgrade your nodes to one of the following Anthos on Azure versions:
Upgrade your cluster to a patched version. Patches will be available in an upcoming release. This bulletin will be updated when they are available. What vulnerabilities are addressed by this patch? |
High |
Anthos on bare metal
Description | Severity |
---|---|
Two security vulnerabilities, CVE-2022-1055 and CVE-2022-27666 have been discovered in the Linux kernel. Each can lead to a local attacker being able to perform a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all GKE node operating systems (Container-Optimized OS and Ubuntu). Technical detailsIn CVE-2022-1055, an attacker can exploit use-after-free in tc_new_tfilter() which allows a local attacker in the container to escalate privileges to root on node. In CVE-2022-27666, buffer overflow in esp/esp6_output_head allows a local attacker in the container to escalate privileges to root on the node. What should I do?There is no action required. Anthos on bare metal is not affected by this CVE as it does not include Linux as part of its package. You should ensure that the node images you use are updated to versions that contain the fix for CVE-2022-1055 and CVE-2022-27666. What vulnerabilities are addressed by this patch? |
High |
GCP-2022-013
Published: 2022-04-11
Updated: 2022-04-20
Reference: CVE-2022-23648
2022-04-22 Update: Updated patch versions for Anthos on bare metal and Anthos clusters on VMware.
GKE
Description | Severity |
---|---|
A security vulnerability, CVE-2022-23648, has been discovered in containerd's handling of path traversal in the OCI image volume specification. Containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain full read access to arbitrary files and directories on the host. This vulnerability may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy). This vulnerability affects all GKE node operating systems (Container-Optimized OS and Ubuntu) which use containerd by default. All GKE, Autopilot, and GKE Sandbox nodes are affected. What should I do?The versions of Linux node images for the following versions of GKE have been updated with code to fix this vulnerability. For security purposes, even if you have node-autoupgrade enabled, we recommend that you manually upgrade your nodes to one of the following GKE versions:
A recent feature of release channels allows you to apply a patch without having to unsubscribe from a channel. This lets you secure your nodes until the new version becomes the default for your specific release channel. |
Medium |
Anthos clusters on VMware
Updated: 2022-04-22
Description | Severity |
---|---|
A security vulnerability, CVE-2022-23648, has been discovered in containerd's handling of path traversal in the OCI image volume specification. Containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain full read access to arbitrary files and directories on the host. This vulnerability may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy). This vulnerability affects all Anthos clusters on VMware with stackdriver enabled, which uses containerd. Anthos clusters on VMware versions 1.8, 1.9, and 1.10 are affected What should I do?2022-04-22 Update: The following versions of Anthos clusters on VMware contain code that fixes this vulnerability.
The following versions of Anthos clusters on VMware have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos clusters on VMware versions:
This CVE can be mitigated by setting IgnoreImageDefinedVolumes to true. |
Medium |
Anthos clusters on AWS
Description | Severity |
---|---|
A security vulnerability, CVE-2022-23648, has been discovered in containerd's handling of path traversal in the OCI image volume specification. Containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain full read access to arbitrary files and directories on the host. This vulnerability may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy). All Anthos clusters on AWS versions are affected. What should I do?The following versions of Anthos clusters on AWS have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos clusters on AWS versions. Anthos clusters on AWS (current generation)
Anthos clusters on AWS (previous generation)
This CVE can be mitigated by setting IgnoreImageDefinedVolumes to true. |
Medium |
Anthos on Azure
Description | Severity |
---|---|
A security vulnerability, CVE-2022-23648, has been discovered in containerd's handling of path traversal in the OCI image volume specification. Containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain full read access to arbitrary files and directories on the host. This vulnerability may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy). All Anthos on Azure versions are affected. What should I do?The following versions of Anthos on Azure have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes as follows:
This CVE can be mitigated by setting IgnoreImageDefinedVolumes to true. |
Medium |
Anthos on bare metal
Updated: 2022-04-22
Description | Severity |
---|---|
A security vulnerability, CVE-2022-23648, has been discovered in containerd's handling of path traversal in the OCI image volume specification. Containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain full read access to arbitrary files and directories on the host. This vulnerability may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy). This vulnerability affects all Anthos on bare metal which use containerd. Anthos on bare metal versions 1.8, 1.9, and 1.10 are affected What should I do?2022-04-22 Update: The following versions of Anthos on bare metal contain code that fixes this vulnerability.
The following versions of Anthos on bare metal have been updated with code to fix this vulnerability. We recommend that you upgrade your nodes to one of the following Anthos on bare metal versions:
This CVE can be mitigated by setting IgnoreImageDefinedVolumes to true. |
Medium |
GCP-2022-012
Published: 2022-04-07
Updated: 2022-11-22
Reference: CVE-2022-0847
2022-11-22 Update: Updated information about workloads using GKE Sandbox.
GKE
Updated: 2022-11-22
Description | Severity |
---|---|
2022-11-22 update: Workloads using GKE Sandbox are not affected by these vulnerabilities. A security vulnerability, CVE-2022-0847, has been discovered in the Linux kernel version 5.8 and later that can potentially escalate container privileges to root. This vulnerability affects all GKE node pool versions v1.22 and later that use Container-Optimized OS images (Container-Optimized OS 93 and later). GKE node pools that use the Ubuntu OS are not affected. What should I do?The versions of Linux node images for the following versions of GKE have been updated with code to fix this vulnerability. For security purposes, even if you have node-autoupgrade enabled, we recommend that you manually upgrade your node pools to one of the following GKE versions:
A recent feature of release channels allows you to apply a patch version of other release channels without having to unsubscribe from a channel. This lets you secure your nodes until the new version becomes the default for your release specific channel. What vulnerabilities are addressed by this patch?CVE-2022-0847 relates to the PIPE_BUF_FLAG_CAN_MERGE flag that was introduced in version 5.8 of the Linux kernel. In this vulnerability, the "flags" member of the new pipe buffer structure was lacking proper initialization in the Linux kernel. An unprivileged local attacker can use this flaw to write to pages in the page cache backed by read only files and escalate their privileges. New versions of Container-Optimized OS that fix this issue have been integrated into the updated node pool versions of GKE. |
High |
Anthos clusters on VMware
Description | Severity |
---|---|
A security vulnerability, CVE-2022-0847, has been discovered in the Linux kernel version 5.8 and later that can potentially escalate privileges to root. This vulnerability affects Anthos clusters on VMware v1.10 for Container-Optimized OS images. Currently, Anthos clusters on VMware with Ubuntu is on kernel version 5.4 and is not vulnerable to this attack. What should I do?The versions of Linux node images for the following versions of Anthos clusters on VMware have been updated with code to fix this vulnerability. We recommend that you upgrade your admin and user clusters to the following Anthos clusters on VMware version:
What vulnerabilities are addressed by this patch?CVE-2022-0847 relates to the PIPE_BUF_FLAG_CAN_MERGE flag that was introduced in version 5.8 of the Linux kernel. In this vulnerability, the "flags" member of the new pipe buffer structure was lacking proper initialization in the Linux kernel. An unprivileged local attacker can use this flaw to write to pages in the page cache backed by read only files and escalate their privileges. New versions of Container-Optimized OS that fix this issue have been integrated into the updated versions of Anthos clusters on VMware. |
High |
Anthos clusters on AWS
Description | Severity |
---|---|
A security vulnerability, CVE-2022-0847, has been discovered in the Linux kernel version 5.8 and later that can potentially escalate privileges to root. This vulnerability affects managed clusters of Anthos clusters on AWS v1.21 and clusters running on Anthos clusters on AWS (previous generation) v1.19, v1.20, v1.21, which use Ubuntu. What should I do?The versions of Linux node images for the following versions of Anthos clusters on AWS have been updated with code to fix this vulnerability. For managed Anthos clusters on AWS, we recommend that you upgrade your user clusters and nodepool to one of the following versions:
For k-lite Anthos clusters on AWS, we recommend that you upgrade your AWSManagementService, AWSCluster and AWSNodePool objects to the following version:
What vulnerabilities are addressed by this patch?CVE-2022-0847 relates to the PIPE_BUF_FLAG_CAN_MERGE flag that was introduced in version 5.8 of the Linux kernel. In this vulnerability, the "flags" member of the new pipe buffer structure was lacking proper initialization in the Linux kernel. An unprivileged local attacker can use this flaw to write to pages in the page cache backed by read only files and escalate their privileges. |
High |
Anthos on Azure
Description | Severity |
---|---|
A security vulnerability, CVE-2022-0847, has been discovered in the Linux kernel version 5.8 and later that can potentially escalate privileges to root. This vulnerability affects managed clusters of Anthos on Azure v1.21 which use Ubuntu. What should I do?The versions of Linux node images for the following versions of Anthos on Azure have been updated with code to fix this vulnerability. We recommend that you upgrade your user clusters and nodepool to the following version:
What vulnerabilities are addressed by this patch?CVE-2022-0847 relates to the PIPE_BUF_FLAG_CAN_MERGE flag that was introduced in version 5.8 of the Linux kernel. In this vulnerability, the "flags" member of the new pipe buffer structure was lacking proper initialization in the Linux kernel. An unprivileged local attacker can use this flaw to write to pages in the page cache backed by read only files and escalate their privileges. |
High |
Anthos on bare metal
Description | Severity |
---|---|
A security vulnerability, CVE-2022-0847, has been discovered in the Linux kernel version 5.8 and later that can potentially escalate privileges to root. What should I do?There is no action required. Anthos on bare metal is not affected by this CVE as it does not include Linux as part of its package. You should ensure that the node images you use are updated to versions that contain the fix for CVE-2022-0847. |
High |
GCP-2022-011
Published: 2022-03-22
Updated: 2022-08-11
2022-08-11 Update: Added more details about the effects of the SMT misconfiguration.
GKE
Description | Severity |
---|---|
Update 2022-08-11: Added more information about the Simultaneous Multi-Threading (SMT) configuration. SMT was intended to be disabled, but was enabled on the versions listed. If you manually enabled SMT for a sandboxed node pool, SMT will remain manually enabled despite this issue. There is a misconfiguration with Simultaneous Multi-Threading (SMT), also known as Hyper-threading, on GKE Sandbox images. The misconfiguration leaves nodes potentially exposed to side channel attacks such as Microarchitectural Data Sampling (MDS) (for more context, see GKE Sandbox documentation). We do not recommend using the following affected versions:
If you manually enabled SMT for a node pool, then this issue does not affect your sandboxed nodes. What should I do?Upgrade your nodes to one of the following versions:
What vulnerability is addressed by this patch?GKE Sandbox nodes have SMT disabled by default, mitigating side-channel attacks. |
Medium |
GCP-2022-009
Published: 2022-03-01
Updated: 2022-03-15
GKE
Description | Severity |
---|---|
Update 2022-03-15: Added hardening guides for Anthos clusters on AWS (GKE on AWS) and Anthos on Azure. Added a section on persistence using webhooks. Some unexpected paths to access the node VM on GKE Autopilot clusters could have been used to escalate privileges in the cluster. These issues have been fixed and no further action is required. The fixes address issues reported through our Vulnerability Reward Program. GKE Standard and Anthos clusters users can optionally apply a similar hardening policy as described below. Technical detailsHost access using third party policy exemptionsIn order to allow Google Cloud to offer full management of nodes, and a Pod-level SLA, GKE Autopilot restricts some highly privileged Kubernetes primitives to limit workloads from having low-level access to the node VM. To set this in context: GKE Standard presents full access to the underlying compute, Autopilot presents limited access, and Cloud Run presents no access. Autopilot relaxes some of those restrictions for a predefined list of third party tools to allow customers to run those tools on Autopilot without modification. Using privileges to create pods with host path mounts, the researcher was able to run a privileged container in a pod that looked like one of these allowlisted third party tools to gain access to the host. The ability to schedule pods in this way is expected on GKE Standard, but not on GKE Autopilot, as it bypassed the host-access restrictions used to enable the SLA described previously. This issue was fixed by tightening the third party allow-listing pod specification. Privilege escalation from root-on-nodeIn addition to the host access, the We have deprecated and removed the As a system hardening measure to prevent this type of attack in the future, we'll apply an Autopilot constraint in an upcoming release that prevents updates to the service account of various objects in the
Addition 2022-03-15: Persistence using mutating webhooksMutating webhooks were used in the report to establish a privileged foothold in the cluster post-compromise. These are standard parts of the Kubernetes API created by cluster admins, and were made visible to administrators when Autopilot added support for customer-defined webhooks. Privileged service accounts in the default namespaceAutopilot policy enforcers previously allowlisted two service accounts in the default namespace: What should I do?All GKE Autopilot clusters have had their policies updated to remove the unintended host access and no further action is required. Further policy hardening will be applied to Autopilot in the coming weeks as a secondary protection. No action is required. GKE Standard clusters and Anthos clusters are unaffected as users already have access to the host. As a system hardening measure, GKE Standard clusters and Anthos clusters users can apply similar protection with a Gatekeeper policy that prevents privileged workload self-modification. For instructions, refer to the following hardening guides:
|
Low |
GCP-2022-008
Published: 2022-02-23
Updated: 2022-04-28
Reference:
CVE-2022-23606,
CVE-2022-21655,
CVE-2021-43826,
CVE-2021-43825,
CVE-2021-43824,
CVE-2022-21654,
CVE-2022-21657,
CVE-2022-21656
GKE
Description | Severity |
---|---|
The Envoy project recently discovered a set of vulnerabilities, CVE-2022-23606,
CVE-2022-21655,
CVE-2021-43826,
CVE-2021-43825,
CVE-2021-43824,
CVE-2022-21654,
CVE-2022-21657, and
CVE-2022-21656
which may impact GKE clusters using Anthos Service Mesh,
Istio-on-GKE, or custom Istio deployments. All issues listed below are fixed in Envoy release 1.21.1. Technical Background Additional details for these vulnerabilities are available here. What should I do?GKE clusters running Anthos Service Mesh should upgrade to a supported version with fix to the above vulnerabilities
GKE clusters running Istio-on-GKE should upgrade to a supported version with fix to the above vulnerabilities
What vulnerabilities are addressed by this patch?CVE-2022-23606, CVE-2022-21655, CVE-2021-43826, CVE-2021-43825, CVE-2021-43824, CVE-2022-21654, CVE-2022-21657, and CVE-2022-21656 |
High |
Anthos clusters on VMware
Updated: 2022-04-28
Description | Severity |
---|---|
Envoy recently released multiple security vulnerability fixes. Anthos clusters on VMware is
impacted because Envoy is used with metrics-server. The
Envoy CVEs we are fixing are listed below. We will update this
bulletin with specific versions when they're available:
Istio recently released one security vulnerability fix. Anthos on VMware is impacted because Istio is used for ingress. The Istio CVEs we are fixing are listed below. We will update this bulletin with specific versions when they're available: CVE-2022-23635 (CVSS score 7.5, High): Istiod crashes upon receiving requests with a specially crafted `authorization` header.For the full descriptions and impacts of the above CVEs, please refer to the security bulletins. 2022-04-28 Addition: What should I do?The following versions of Anthos clusters on VMware fix these vulnerabilities:
What vulnerabilities are addressed by this patch?CVE-2022-23606, CVE-2022-21655, CVE-2021-43826, CVE-2021-43825, CVE-2021-43824, CVE-2022-21654, CVE-2022-21657, and CVE-2022-21656 |
High |
Anthos on bare metal
Description | Severity |
---|---|
Envoy recently released multiple security vulnerability fixes. Anthos
on Bare metal is impacted because Envoy is used for metrics-server.
The Envoy CVEs we are fixing in release 1.10.3, 1.9.6, and 1.8.9 are
listed below:
For the full descriptions and impacts of the above CVEs, please refer to the security bulletins. What vulnerabilities are addressed by this patch?CVE-2022-23606, CVE-2022-21655, CVE-2021-43826, CVE-2021-43825, CVE-2021-43824, CVE-2022-21654, CVE-2022-21657, and CVE-2022-21656 |
High |
GCP-2022-006
Published: 2022-02-14
Updated: 2022-05-16
2022-05-16 Update: Added GKE version 1.19.16-gke.7800 or later to the list of versions that have code to fix this vulnerability.
2022-05-12 Update: Updated patch versions for GKE,
Anthos on bare metal, Anthos clusters on VMware, and Anthos clusters on AWS.
Fixed an issue where the security bulletin for Anthos clusters on AWS was not
displayed when it was added on 2022-02-23.
GKE
Description | Severity |
---|---|
A security vulnerability, CVE-2022-0492,
has been discovered in the Linux kernel's What should I do?2022-05-16 Update: In addition to the GKE versions mentioned in the 2022-05-12 update, GKE version 1.19.16-gke.7800 or later also contains code that fixes this vulnerability. 2022-05-12 Update: The following versions of GKE contain code that fixes this vulnerability:
Update 2022-02-15: Corrected gVisor statement. The vulnerability is found in the Linux kernel's
Patches will be available in an upcoming release. This bulletin will be updated when they are available. What vulnerability is addressed by this patch?CVE-2022-0492 |
Low |
Anthos clusters on
Description | Severity |
---|---|
A security vulnerability, CVE-2022-0492,
has been discovered in the Linux kernel's What should I do?2022-05-12 Update: The following versions of Anthos clusters on VMware contain code that fixes this vulnerability. COS
The vulnerability is found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function and can be used as a container breakout. Anthos clusters on VMware are unaffected due to protection from the default AppArmor profile on Ubuntu and COS. However, some customers may still be vulnerable if they have loosened security restrictions on pods through modification of the Pod or container securityContext field e.g. by disabling/changing the AppArmor profile, which is not recommended. Patches will be available in an upcoming release. This bulletin will be updated when they are available. What vulnerability is addressed by this patch?CVE-2022-0492 |
Low |
Anthos clusters on AWS
Description | Severity |
---|---|
A security vulnerability, CVE-2022-0492,
has been discovered in the Linux kernel's What should I do?2022-05-12 Update: The following versions of current and previous generation Anthos clusters on AWS contain code that fixes this vulnerability: Current generation
Update 2022-02-23: Added note for Anthos clusters on AWS. Anthos clusters on AWS previous and current generations are unaffected due to protection from the default AppArmor profile on Ubuntu. However, some customers may still be vulnerable if they have loosened security restrictions on pods through modification of the Pod or container securityContext field e.g. by disabling/changing the AppArmor profile, which is not recommended. Patches will be available in an upcoming release. This bulletin will be updated when they are available. What vulnerability is addressed by this patch?CVE-2022-0492 |
Low |
Anthos on
Description | Severity |
---|---|
A security vulnerability, CVE-2022-0492,
has been discovered in the Linux kernel's What should I do?2022-05-12 Update: The following versions of Anthos on Azure contain code that fixes this vulnerability:
Anthos on Azure are unaffected due to protection from the default AppArmor profile on Ubuntu. However, some customers may still be vulnerable if they have loosened security restrictions on pods through modification of the Pod or container securityContext field e.g. by disabling/changing the AppArmor profile, which is not recommended. Patches will be available in an upcoming release. This bulletin will be updated when they are available. What vulnerability is addressed by this patch?CVE-2022-0492 |
Low |
GCP-2022-005
Published: 2022-02-11Updated: 2022-02-15
Reference: CVE-2021-43527
GKE
Description | Severity |
---|---|
Update 2022-02-15: Some GKE versions mentioned in the original
bulletin were combined with other fixes and had their version numbers incremented prior to release. Patches are available in the following GKE
versions:
A security vulnerability, CVE-2021-43527, has been discovered in any binary that links to the vulnerable versions of libnss3 found in NSS (Network Security Services) versions prior to 3.73 or 3.68.1. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how NSS is used/configured. Both GKE COS and Ubuntu images have a vulnerable version installed, and need to be patched. Potentially, CVE-2021-43527 can have a wide impact across applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS#7, or PKCS#12. As well as applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted. Impact depends on how NSS is used/configured. GKE doesn't use libnss3 for any Internet-accessible APIs. The impact is limited to on-host code running outside containers, which is small due to the minimal design of Chrome OS. GKE code running inside containers using the golang distroless base image is unaffected. What should I do?The versions of Linux node images for the following versions of GKE have been updated with code to fix these vulnerabilities. Upgrade your control plane and nodes to one of the following GKE versions:
What vulnerability is addressed by this patch? |
Medium |
Anthos clusters on
Description | Severity |
---|---|
A security vulnerability, CVE-2021-43527, has been discovered in any binary that links to the vulnerable versions of libnss3 found in NSS (Network Security Services) versions prior to 3.73 or 3.68.1. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Both Anthos clusters on VMware COS and Ubuntu images have a vulnerable version installed, and need to be patched. Potentially, CVE-2021-43527 can have a wide impact across with applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12. As well as applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted. Impact depends on how they configure/use NSS. Anthos on VMware doesn't use libnss3 for any publicly accessible APIs, therefore the impact is limited and this CVE's severity for Anthos clusters on VMware is rated as Medium. What should I do?The versions of Linux node images for the following versions of Anthos have been updated with code to fix these vulnerabilities. Upgrade your control plane and nodes to one of the following Anthos versions:
Are you using an Anthos clusters on VMware version older than 1.18? You are using an Anthos version out of SLA and should consider upgrading to one of the supported versions. What vulnerability is addressed by this patch? |
Medium |
Anthos on
Description | Severity |
---|---|
A security vulnerability, CVE-2021-43527, has been discovered in any binary that links to the vulnerable versions of libnss3 found in NSS (Network Security Services) versions prior to 3.73 or 3.68.1. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how NSS is used/configured. Anthos clusters on Azure Ubuntu images have a vulnerable version installed, and need to be patched. Potentially, CVE-2021-43527 can have a wide impact across with applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS#7, or PKCS#12. As well as applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted. Impact depends on how they configure/use NSS. Anthos clusters on Azure doesn't use libnss3 for any publicly accessible APIs, therefore the impact is limited and this CVE's severity for Anthos on Azure is rated as Medium. What should I do?The versions of Linux node images for the following versions of Anthos on Azure have been updated with code to fix these vulnerabilities. Upgrade your clusters to one of the following Anthos on Azure versions:
What vulnerability is addressed by this patch? |
Medium |
GCP-2022-004
Published: 2022-02-04Reference: CVE-2021-4034
GKE
Description | Severity |
---|---|
A security vulnerability, CVE-2021-4034, has been discovered in pkexec, a part of the Linux policy kit package (polkit), that allows an authenticated user to perform a privilege escalation attack. PolicyKit is generally used only on Linux desktop systems to allow non-root users to perform actions such as rebooting the system, installing packages, restarting services etc, as governed by a policy. What should I do?GKE is unaffected because the vulnerable module, policykit-1, is not installed on COS or Ubuntu images used in GKE. No action is required. |
None |
Anthos clusters on
Description | Severity |
---|---|
A security vulnerability, CVE-2021-4034, has been discovered in pkexec, a part of the Linux policy kit package (polkit), that allows an authenticated user to perform a privilege escalation attack. PolicyKit is generally used only on Linux desktop systems to allow non-root users to perform actions such as rebooting the system, installing packages, restarting services etc, as governed by a policy. The Anthos default configuration already gives users full "sudo" privileges, so this exploit does not change Anthos existing security posture Technical detailsFor this bug to be exploitable, an attacker needs both a non-root shell on the node filesystem and to have the vulnerable version of pkexec installed. While Anthos clusters on VMware does include a version of policykit-1 in its release images, the Anthos default configuration allows passwordless sudo to anyone with shell access already, so this vulnerability does not give a user any more privileges than they already have. What should I do?No action is required. Anthos clusters on VMware is unaffected. |
None |
Anthos clusters on
Description | Severity |
---|---|
Anthos clusters on AWS is unaffected. The vulnerable module, policykit-1, is not installed on Ubuntu images used by the current and previous versions of Anthos clusters on AWS. | None |
Anthos on
Description | Severity |
---|---|
A security vulnerability, CVE-2021-4034, has been discovered in pkexec, a part of the Linux policy kit package (polkit), that allows an authenticated user to perform a privilege escalation attack. PolicyKit is generally used only on Linux desktop systems to allow non-root users to perform actions such as rebooting the system, installing packages, restarting services etc, as governed by a policy. The Anthos default configuration already gives users full "sudo" privileges, so this exploit does not change Anthos existing security posture Technical detailsFor this bug to be exploitable, an attacker needs both a non-root shell on the node filesystem and to have the vulnerable version of pkexec installed. While Anthos on Azure does include a version of policykit-1 in its release images, the Anthos default configuration allows passwordless sudo to anyone with shell access already, so this vulnerability does not give a user any more privileges than they already have. What should I do?No action is required. Anthos on Azure is unaffected. |
None |
Anthos clusters on
Description | Severity |
---|---|
Anthos on bare metal might be affected depending on packages that are installed on the customer-managed operating system. Scan your OS images and patch them if necessary. | None |
GCP-2022-002
Published: 2022-02-01Updated: 2022-03-07
Reference: CVE-2021-4154, CVE-2021-22600, CVE-2022-0185
2022-02-04 Update: Added sections for Anthos clusters on AWS and Anthos on Azure. Added rollout updates for GKE and Anthos clusters on VMware.
GKE
Updated: 2022-03-07
Description | Severity |
---|---|
Three security vulnerabilities, CVE-2021-4154, CVE-2021-22600, and CVE-2022-0185, have been discovered in the Linux kernel, each of which can lead to either a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all node operating systems (COS and Ubuntu) on GKE, Anthos clusters on VMware, Anthos clusters on AWS (current and previous generation), and Anthos on Azure. Pods using GKE Sandbox are not vulnerable to these vulnerabilities. See the COS release notes for more details. Technical detailsIn CVE-2021-4154, an attacker can exploit the CVE-2021-22600 is a double free exploit in packet_set_ring that can lead to a container escape to the host node. With CVE-2022-0185, a heap overflow bug in legacy_parse_param() may lead to an out-of-bounds write that will cause a container breakout. The exploitation path for this vulnerability that relies on the "unshare" syscall is blocked on GKE Autopilot clusters by default using seccomp filtering. Users who have manually enabled the default container runtime seccomp profile on GKE Standard clusters are also protected. What should I do?2022-03-07 Update:The versions of Linux node images for the following versions of GKE have been updated with code to fix all these vulnerabilities for both Ubuntu and COS images. Upgrade your control plane and nodes to one of the following GKE versions.
2022-02-25 Update:If you use Ubuntu node images, 1.22.6-gke.1000 does not address CVE-2021-22600. We will update this bulletin with Ubuntu patch versions when they are available. 2022-02-23 Update: The versions of Linux node images for the following versions of GKE have been updated with code to fix these vulnerabilities. Upgrade your clusters to one of the following GKE versions.
2022-02-04 Update: The rollout start date for GKE patch versions was February 2. The versions of Linux node images for the following versions of GKE have been updated with code to fix these vulnerabilities. Upgrade your clusters to one of the following GKE versions.
1.22 and 1.23 versions are also in progress. We will update this bulletin with specific versions when they're available. What vulnerability is addressed by this patch? |
High |
Anthos clusters on
Updated: 2022-02-23
Description | Severity |
---|---|
Three security vulnerabilities, CVE-2021-4154, CVE-2021-22600, and CVE-2022-0185, have been discovered in the Linux kernel, each of which can lead to either a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all node operating systems (COS and Ubuntu) on GKE, Anthos clusters on VMware, Anthos clusters on AWS (current and previous generation), and Anthos on Azure. See the COS release notes for more details. Technical detailsIn CVE-2021-4154, an attacker can exploit the CVE-2021-22600 is a double free exploit in packet_set_ring that can lead to a container escape to the host node. With CVE-2022-0185, a heap overflow bug in legacy_parse_param() may lead to an out-of-bounds write that will cause a container breakout. Users who have manually enabled the default container runtime seccomp profile on GKE Standard clusters are also protected. What should I do?2022-02-23 Update: version 1.10.2 (Fixes CVE-2021-22600, CVE-2021-4154, and CVE-2022-0185) is now scheduled for March 1. 2022-02-23 Update: Added patched versions addressing CVE-2021-2260. Version 1.10.1 does not address CVE-2021-22600 but does address the other vulnerabilities. Versions 1.9.4 and 1.10.2, both unreleased, will address CVE-2021-22600. The versions of Linux node images for the following versions of Anthos clusters on VMware have been updated with code to fix these vulnerabilities. Upgrade your clusters to one of the following Anthos clusters on VMware versions:
2022-02-04 Update: Added information about Ubuntu images not addressing CVE-2021-22600. The versions of Linux node images for the following versions of Anthos clusters on VMware have been updated with code to fix these vulnerabilities. Upgrade your clusters to one of the following Anthos clusters on VMware versions:
What vulnerability is addressed by this patch? |
High |
Anthos clusters on
Description | Severity |
---|---|
Three security vulnerabilities, CVE-2021-4154, CVE-2021-22600, and CVE-2022-0185, have been discovered in the Linux kernel, each of which can lead to either a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all node operating systems (COS and Ubuntu) on GKE, Anthos clusters on VMware, Anthos clusters on AWS (current and previous generation), and Anthos on Azure. See the COS release notes for more details. Technical detailsIn CVE-2021-4154, an attacker can exploit the CVE-2021-22600 is a double free exploit in packet_set_ring that can lead to a container escape to the host node. With CVE-2022-0185, a heap overflow bug in legacy_parse_param() may lead to an out-of-bounds write that will cause a container breakout. Users who have manually enabled the default container runtime seccomp profile on GKE Standard clusters are also protected. What should I do?Anthos clusters on AWSThe versions of Linux node images for the following versions of Anthos clusters on AWS have been updated with code to fix these vulnerabilities. Upgrade your clusters to the following Anthos clusters on AWS version:
Anthos clusters on AWS (previous generation)The versions of Linux node images for the following versions of Anthos clusters on AWS (previous generation) have been updated with code to fix these vulnerabilities. Upgrade your clusters to one of the following Anthos clusters on AWS (previous generation) versions:
What vulnerability is addressed by this patch? |
High |
Anthos on
Description | Severity |
---|---|
Three security vulnerabilities, CVE-2021-4154, CVE-2021-22600, and CVE-2022-0185, have been discovered in the Linux kernel, each of which can lead to either a container breakout, privilege escalation on the host, or both. These vulnerabilities affect all node operating systems (COS and Ubuntu) on GKE, Anthos clusters on VMware, Anthos clusters on AWS (current and previous generation), and Anthos on Azure. See the COS release notes for more details. Technical detailsIn CVE-2021-4154, an attacker can exploit the CVE-2021-22600 is a double free exploit in packet_set_ring that can lead to a container escape to the host node. With CVE-2022-0185, a heap overflow bug in legacy_parse_param() may lead to an out-of-bounds write that will cause a container breakout. Users who have manually enabled the default container runtime seccomp profile on GKE Standard clusters are also protected. What should I do?The versions of Linux node images for the following versions of Anthos on Azure have been updated with code to fix these vulnerabilities. Upgrade your clusters to the following Anthos on Azure version:
What vulnerability is addressed by this patch? |
High |
GCP-2021-024
Published: 2021-10-21Reference: CVE-2021-25742
GKE
Description | Severity |
---|---|
A security issue was discovered in the Kubernetes ingress-nginx controller, CVE-2021-25742. Ingress-nginx custom snippets allows retrieval of ingress-nginx service account tokens and secrets across all namespaces. What should I do?This security issue does not impact your GKE cluster infrastructure or any Anthos environments cluster infrastructure. If you use ingress-nginx in your workload deployments, you should be aware of this security issue. See ingress-nginx Issue 7837 for more details. |
None |
Anthos clusters on
Description | Severity |
---|---|
A security issue was discovered in the Kubernetes ingress-nginx controller, CVE-2021-25742. Ingress-nginx custom snippets allows retrieval of ingress-nginx service account tokens and secrets across all namespaces. What should I do?This security issue does not impact your GKE cluster infrastructure or any Anthos environments cluster infrastructure. If you use ingress-nginx in your workload deployments, you should be aware of this security issue. See ingress-nginx Issue 7837 for more details. |
None |
Anthos clusters on
Description | Severity |
---|---|
A security issue was discovered in the Kubernetes ingress-nginx controller, CVE-2021-25742. Ingress-nginx custom snippets allows retrieval of ingress-nginx service account tokens and secrets across all namespaces. What should I do?This security issue does not impact your GKE cluster infrastructure or any Anthos environments cluster infrastructure. If you use ingress-nginx in your workload deployments, you should be aware of this security issue. See ingress-nginx Issue 7837 for more details. |
None |
Anthos clusters on
Description | Severity |
---|---|
A security issue was discovered in the Kubernetes ingress-nginx controller, CVE-2021-25742. Ingress-nginx custom snippets allows retrieval of ingress-nginx service account tokens and secrets across all namespaces. What should I do?This security issue does not impact your GKE cluster infrastructure or any Anthos environments cluster infrastructure. If you use ingress-nginx in your workload deployments, you should be aware of this security issue. See ingress-nginx Issue 7837 for more details. |
None |
GCP-2021-019
Published: 2021-09-29GKE
Description | Severity |
---|---|
There is a known issue where updating a Am I impacted?If your kubectl get backendconfigs -A -o json | \ jq -r '.items[] | select(.spec.securityPolicy == {}) | .metadata | "\(.namespace)/\(.name)"'
This issue affects the following GKE versions:
If you do not configure Google Cloud Armor on your Ingress resources via the What should I do?Upgrade your GKE control plane to one of the following updated versions that
patches this issue and allows
This issue can also be prevented by avoiding the deployment of To prevent this issue, only make updates to your Since the The following sample manifest describes a apiVersion: cloud.google.com/v1 kind: BackendConfig metadata: name: my-backend-config spec: securityPolicy: name: "ca-how-to-security-policy" If you have CI/CD systems or tools which regularly update |
Low |
GCP-2021-022
Published: 2021-09-23Anthos clusters on
Description | Severity |
---|---|
A vulnerability has been discovered in the Anthos Identity Service (AIS) LDAP module of Anthos clusters on VMware versions 1.8 and 1.8.1 where a seed key used in generating keys is predictable. With this vulnerability, an authenticated user could add arbitrary claims and escalate privileges indefinitely. Technical detailsA recent addition to AIS code creates symmetric keys using golang's math/rand module, which is not suitable for security-sensitive code. The module is used in a way that will generate a predictable key. During identity verification, a secure token service (STS) key is generated that is subsequently encrypted with a symmetric key that is simple to derive. What should I do?This vulnerability only affects customers using AIS in Anthos clusters on VMware versions 1.8 and 1.8.1. For users of Anthos clusters on VMware 1.8, upgrade your clusters to the following version:
|
High |
GCP-2021-021
Published: 2021-09-22Reference: CVE-2020-8561
GKE
Description | Severity |
---|---|
A security vulnerability, CVE-2020-8561,
has been discovered in Kubernetes where certain webhooks can be made to
redirect Technical detailsWith this vulnerability, actors who control the responses of
This issue can be mitigated by changing certain parameters for the API server. What should I do?No action is required at this time. Currently available versions of GKE and Anthos have implemented the following mitigations that protect against this type of attack:
What vulnerability is addressed by this patch?CVE-2020-8561 |
Medium |
Anthos clusters on
Description | Severity |
---|---|
A security vulnerability, CVE-2020-8561,
has been discovered in Kubernetes where certain webhooks can be made to
redirect Technical detailsWith this vulnerability, actors who control the responses of
This issue can be mitigated by changing certain parameters for the API server. What should I do?No action is required at this time. Currently available versions of GKE and Anthos have implemented the following mitigations that protect against this type of attack:
What vulnerability is addressed by this patch?CVE-2020-8561 |
Medium |
Anthos clusters on
Description | Severity |
---|---|
A security vulnerability, CVE-2020-8561,
has been discovered in Kubernetes where certain webhooks can be made to
redirect Technical detailsWith this vulnerability, actors who control the responses of
This issue can be mitigated by changing certain parameters for the API server. What should I do?No action is required at this time. Currently available versions of GKE and Anthos have implemented the following mitigations that protect against this type of attack:
What vulnerability is addressed by this patch?CVE-2020-8561 |
Medium |
Anthos clusters on
Description | Severity |
---|---|
A security vulnerability, CVE-2020-8561,
has been discovered in Kubernetes where certain webhooks can be made to
redirect Technical detailsWith this vulnerability, actors who control the responses of
This issue can be mitigated by changing certain parameters for the API server. What should I do?No action is required at this time. Currently available versions of GKE and Anthos have implemented the following mitigations that protect against this type of attack:
What vulnerability is addressed by this patch?CVE-2020-8561 |
Medium |
GCP-2021-018
Published: 2021-09-15Updated: 2021-09-24
Reference: CVE-2021-25741
2021-09-24 update: Anthos clusters on bare metal bulletin updated with additional patched versions.
2021-09-20 update: Bulletins added for Anthos clusters on bare metal
2021-09-16 update: Bulletins added for Anthos clusters on VMware
GKE
Description | Severity |
---|---|
A security issue was discovered in Kubernetes, CVE-2021-25741, where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem. Technical details:In CVE-2021-25741, the attacker can create a symbolic link from a mounted emptyDir to the root filesystem of the node ( / ), the kubelet will follow the symlink and mount the host root into the container.What should I do?We recommend you to upgrade your node pools to one of the following versions or above to take advantage of the latest patches:
The following versions also contain the fix:
|
High |
Anthos clusters on
Description | Severity |
---|---|
A security issue was discovered in Kubernetes, CVE-2021-25741, where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem. Technical details:In CVE-2021-25741, the attacker can create a symbolic link from a mounted emptyDir to the root filesystem of the node ( / ), the kubelet will follow the symlink and mount the host root into the container.What should I do?Updated 2021-09-24: Patched versions 1.8.3 and 1.7.4 are now available. Updated 2021-09-17: Corrected the list of available versions that contain the patch. The following versions of Anthos clusters on VMware have been updated with code to fix this vulnerability. Upgrade your admin clusters and user clusters to one of the following versions:
|
High |
Anthos clusters on
Description | Severity |
---|---|
A security issue was discovered in Kubernetes, CVE-2021-25741, where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem. Technical details:In CVE-2021-25741, the attacker can create a symbolic link from a mounted emptyDir to the root filesystem of the node ( / ), the kubelet will follow the symlink and mount the host root into the container.What should I do?2021-9-16 Update: Added list of supported gke-versions for The following versions of Anthos clusters on AWS have been updated with code to fix this vulnerability. It is recommended that you:
|
High |
Anthos clusters on
Description | Severity |
---|---|
A security issue was discovered in Kubernetes, CVE-2021-25741, where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem. Technical details:In CVE-2021-25741, the attacker can create a symbolic link from a mounted emptyDir to the root filesystem of the node ( / ), the kubelet will follow the symlink and mount the host root into the container.What should I do?The following versions of Anthos clusters on bare metal have been updated with code to fix this vulnerability. Upgrade your admin clusters and user clusters to one of the following versions:
|
High |
GCP-2021-017
Published: 2021-09-01Updated: 2021-09-23
Reference: CVE-2021-33909
CVE-2021-33910
GKE
Description | Severity |
---|---|
2021-09-23 update:Containers running inside of GKE Sandbox are unaffected by this vulnerability for attacks originating inside the container. 2021-09-15 update:The following GKE versions address the vulnerabilities:
Two security vulnerabilities, CVE-2021-33909 and CVE-2021-33910, have been discovered in the Linux kernel that can lead to an OS crash or an escalation to root by an unprivileged user. This vulnerability affects all GKE node operating systems (COS and Ubuntu). Technical details:In CVE-2021-33909, the
Linux kernel's filesystem layer does not properly restrict seq buffer allocations, leading
to an integer overflow, an Out-of-bounds Write, and escalation to root. What should I do?The versions of Linux node images for the following versions of GKE have been updated with code to fix this vulnerability. Upgrade your clusters to one of the following versions:
|
High |
Anthos clusters on
Description | Severity |
---|---|
Two security vulnerabilities, CVE-2021-33909 and CVE-2021-33910, have been discovered in the Linux kernel that can lead to an OS crash or an escalation to root by an unprivileged user. This vulnerability affects all GKE node operating systems (COS and Ubuntu). Technical details:In CVE-2021-33909, the
Linux kernel's filesystem layer does not properly restrict seq buffer allocations, leading
to an integer overflow, an Out-of-bounds Write, and escalation to root. What should I do?The versions of Linux node images for Anthos clusters on AWS have been updated with code
to fix this vulnerability. Upgrade your clusters to one of the following versions:
|
High |
Anthos clusters on
Description | Severity |
---|---|
Two security vulnerabilities, CVE-2021-33909 and CVE-2021-33910, have been discovered in the Linux kernel that can lead to an OS crash or an escalation to root by an unprivileged user. This vulnerability affects all GKE node operating systems (COS and Ubuntu). Technical details:In CVE-2021-33909, the
Linux kernel's filesystem layer does not properly restrict seq buffer allocations, leading
to an integer overflow, an Out-of-bounds Write, and escalation to root. What should I do?The versions of Linux and COS node images for Anthos clusters on VMware have been updated with code
to fix this vulnerability. Upgrade your clusters to one of the following versions:
|
High |
GCP-2021-015
Published: 2021-07-13Updated: 2021-07-15
Reference: CVE-2021-22555
GKE
Description | Severity |
---|---|
A new security vulnerability, CVE-2021-22555,
has been discovered where a malicious actor with Technical details
In this attack, an out-of-bounds write in What should I do?The following versions of Linux on GKE have been updated with code to fix this vulnerability. Upgrade your clusters to one of the following versions:
What vulnerability is addressed by this patch? |
High |
Anthos clusters on
Description | Severity |
---|---|
A new security vulnerability, CVE-2021-22555,
has been discovered where a malicious actor with Technical details
In this attack, an out-of-bounds write in What should I do?The following versions of Linux on Anthos clusters on VMware have been updated with code to fix this vulnerability. Upgrade your clusters to one of the following versions:
What vulnerability is addressed by this patch? |
High |
GCP-2021-014
Published: 2021-07-05Reference: CVE-2021-34527
GKE
Description | Severity |
---|---|
Microsoft published a security bulletin on a Remote code execution (RCE) vulnerability, CVE-2021-34527, that affects the print spooler in Windows servers. The CERT Coordination Center (CERT/CC) published an update note on a related vulnerability, dubbed "PrintNightmare" that also affects Windows print spoolers - PrintNightmare, Critical Windows Print Spooler Vulnerability What should I do?No action is required. GKE Windows nodes do not contain the affected Spooler service as part of the base image, so GKE Windows deployments are not vulnerable to this attack. What vulnerabilities are addressed by this bulletin?
|
High |
GCP-2021-012
Published: 2021-07-01Updated: 2021-07-09
Reference: CVE-2021-34824
GKE
Description | Severity |
---|---|
What should I do?The Istio project recently disclosed a new security vulnerability (CVE-2021-34824) affecting Istio. Istio contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces. Technical details:The Istio secure Gateway or workloads using the DestinationRule can load TLS private keys and certificates from Kubernetes secrets via the credentialName configuration. From Istio 1.8 and above, the secrets are read from istiod and conveyed to gateways and workloads via XDS. Normally, a gateway or workload deployment is only able to access TLS certificates and private keys stored in the secret within its namespace. However, a bug in istiod allows a client authorized to access the Istio XDS API to retrieve any TLS certificate and private keys cached in istiod. What should I do?GKE clusters do not run Istio by default and, when enabled, use Istio version 1.6, which is not vulnerable to this attack. If you have installed or upgraded Istio on the cluster to Istio 1.8 or above, upgrade your Istio to the latest supported version. |
High |
Anthos clusters on
Description | Severity |
---|---|
What should I do?The Istio project recently disclosed a new security vulnerability (CVE-2021-34824) affecting Istio. Istio contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces. Technical details:The Istio secure Gateway or workloads using the DestinationRule can load TLS private keys and certificates from Kubernetes secrets via the credentialName configuration. From Istio 1.8 and above, the secrets are read from istiod and conveyed to gateways and workloads via XDS. Normally, a gateway or workload deployment is only able to access TLS certificates and private keys stored in the secret within its namespace. However, a bug in istiod allows a client authorized to access the Istio XDS API to retrieve any TLS certificate and private keys cached in istiod. What should I do?Anthos clusters on VMware v1.6 and v1.7 are not vulnerable to this attack. Anthos clusters on VMware v1.8 are vulnerable. If you are using Anthos clusters on VMware v1.8, upgrade to the following patched version or later:
|
High |
Anthos clusters on
Description | Severity |
---|---|
What should I do?The Istio project recently disclosed a new security vulnerability (CVE-2021-34824) affecting Istio. Istio contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces. Technical details:The Istio secure Gateway or workloads using the DestinationRule can load TLS private keys and certificates from Kubernetes secrets via the credentialName configuration. From Istio 1.8 and above, the secrets are read from istiod and conveyed to gateways and workloads via XDS. Normally, a gateway or workload deployment is only able to access TLS certificates and private keys stored in the secret within its namespace. However, a bug in istiod allows a client authorized to access the Istio XDS API to retrieve any TLS certificate and private keys cached in istiod. Clusters created or upgraded with Anthos clusters on bare metal v1.8.0 are impacted by this CVE. What should I do?Anthos v1.6 and 1.7 are not vulnerable to this attack. If you have v1.8.0 clusters, download and install the 1.8.1 version of bmctl and upgrade your clusters to the following patched version:
|
High |
GCP-2021-011
Published: 2021-06-04Updated: 2021-10-19
Reference: CVE-2021-30465
2021-10-19 update: Added bulletins for Anthos clusters on VMware, Anthos clusters on AWS, and Anthos clusters on bare metal.
GKE
Description | Severity |
---|---|
The security community recently disclosed a new security vulnerability
(CVE-2021-30465)
found in For GKE, because exploiting this vulnerability requires the ability to create pods, we have rated the severity of this vulnerability at MEDIUM. Technical details
The For this specific attack, a user can potentially exploit a race condition by starting multiple pods on a single node simultaneously, all of which share the same volume mount with a symlink. If the attack succeeds, one of the pods will mount the node's filesystem with root permissions. What should I do?There is a newly released patch to Upgrade your GKE cluster to one of the following updated versions:
|
Medium |
Anthos clusters on
Description | Severity |
---|---|
The security community recently disclosed a new security vulnerability
(CVE-2021-30465)
found in For Anthos clusters on VMware, because exploiting this vulnerability requires the ability to create pods, we have rated the severity of this vulnerability at MEDIUM. Technical details
The For this specific attack, a user can potentially exploit a race condition by starting multiple pods on a single node simultaneously, all of which share the same volume mount with a symlink. If the attack succeeds, one of the pods will mount the node's filesystem with root permissions. What should I do?There is a newly released patch to
|
Medium |
Anthos clusters on
Description | Severity |
---|---|
The security community recently disclosed a new security vulnerability
(CVE-2021-30465)
found in Because this is an OS-level vulnerability, Anthos clusters on AWS are not vulnerable. Technical details
The For this specific attack, a user can potentially exploit a race condition by starting multiple pods on a single node simultaneously, all of which share the same volume mount with a symlink. If the attack succeeds, one of the pods will mount the node's filesystem with root permissions. What should I do?Ensure that the OS version on which you are running Anthos clusters on AWS is upgraded to the latest OS version that has an updatedrunc package.
|
None |
Anthos clusters on
Description | Severity |
---|---|
The security community recently disclosed a new security vulnerability
(CVE-2021-30465)
found in Because this is an OS-level vulnerability, Anthos clusters on bare metal are not vulnerable. Technical details
The For this specific attack, a user can potentially exploit a race condition by starting multiple pods on a single node simultaneously, all of which share the same volume mount with a symlink. If the attack succeeds, one of the pods will mount the node's filesystem with root permissions. What should I do?
Ensure that the OS version on which you are running Anthos on bare metal is
upgraded to the latest OS version that has an updated |
None |
GCP-2021-006
Published: 2021-05-11Reference: CVE-2021-31920
GKE
Description | Severity |
---|---|
The Istio project recently disclosed a new security vulnerability (CVE-2021-31920) affecting Istio. Istio contains a remotely-exploitable vulnerability where an HTTP request with multiple slashes or escaped slash characters can bypass Istio authorization policy when path based authorization rules are used. What should I do?We strongly recommend that you update and reconfigure your GKE clusters. Please note it is important to complete both steps below to successfully resolve the vulnerability:
|
High |
GCP-2021-004
Published: 2021-05-06Reference: CVE-2021-28683, CVE-2021-28682, CVE-2021-29258
GKE
Description | Severity |
---|---|
The Envoy and Istio projects recently announced several new security vulnerabilities (CVE-2021-28683, CVE-2021-28682 and CVE-2021-29258), that could allow an attacker to crash Envoy. GKE clusters do not run Istio by default and are not vulnerable. If Istio has been installed in a cluster and configured to expose services to the internet, those services may be vulnerable to denial of service. What should I do?To fix these vulnerabilities, upgrade your GKE control plane to one of the following patched versions:
|
Medium |
Anthos clusters on
Description | Severity |
---|---|
The Envoy and Istio projects recently announced several new security vulnerabilities (CVE-2021-28683, CVE-2021-28682 and CVE-2021-29258), that could allow an attacker to crash Envoy. Anthos clusters on VMware use Envoy by default for Ingress, so Ingress services may be vulnerable to denial of service. What should I do?To fix these vulnerabilities, upgrade your Anthos clusters on VMware to one of the following patched versions when released:
|
Medium |
Anthos clusters on
Updated: 2021-05-06
Description | Severity |
---|---|
The Envoy and Istio projects recently announced several new security vulnerabilities (CVE-2021-28683, CVE-2021-28682 and CVE-2021-29258), that could allow an attacker to crash Envoy. Anthos on bare metal uses Envoy by default for Ingress, so Ingress services may be vulnerable to denial of service. What should I do?To fix these vulnerabilities, upgrade your Anthos on bare metal cluster to one of the following patched versions when released:
|
Medium |
GCP-2021-003
Published: 2021-04-19Reference: CVE-2021-25735
GKE
Description | Severity |
---|---|
The Kubernetes project recently announced a new security vulnerability, CVE-2021-25735, that could allow node updates to bypass a Validating Admission Webhook. In a scenario where an attacker has sufficient privileges and where a Validating
Admission Webhook is implemented that uses old What should I do?To fix this vulnerability, upgrade your GKE cluster to one of the following patched versions:
|
Medium |
Anthos clusters on
Description | Severity |
---|---|
The Kubernetes project recently announced a new security vulnerability, CVE-2021-25735, that could allow node updates to bypass a Validating Admission Webhook. In a scenario where an attacker has sufficient privileges and where a Validating
Admission Webhook is implemented that uses old What should I do?An upcoming patch version will include a mitigation for this vulnerability. |
Medium |
Anthos clusters on
Description | Severity |
---|---|
The Kubernetes project recently announced a new security vulnerability, CVE-2021-25735, that could allow node updates to bypass a Validating Admission Webhook. In a scenario where an attacker has sufficient privileges and where a Validating
Admission Webhook is implemented that uses old What should I do?An upcoming patch version will include a mitigation for this vulnerability. |
Medium |
Anthos clusters on
Description | Severity |
---|---|
The Kubernetes project recently announced a new security vulnerability, CVE-2021-25735, that could allow node updates to bypass a Validating Admission Webhook. In a scenario where an attacker has sufficient privileges and where a Validating
Admission Webhook is implemented that uses old What should I do?An upcoming patch version will include a mitigation for this vulnerability. |
Medium |
GCP-2021-001
Published: 2021-01-28Reference: CVE-2021-3156
GKE
Description | Severity |
---|---|
A vulnerability was recently discovered in the Linux utility Google Kubernetes Engine (GKE) clusters are not affected by this vulnerability:
What should I do?Because GKE clusters are not affected by this vulnerability, no further action is required. GKE will have the patch for this vulnerability applied in a coming release at regular cadence. |
None |
Anthos clusters on
Description | Severity |
---|---|
A vulnerability was recently discovered in the Linux utility Anthos clusters on VMware are not affected by this vulnerability:
What should I do?Because Anthos clusters on VMware clusters are not affected by this vulnerability, no further action is required. Anthos clusters on VMware will have the patch for this vulnerability applied in a coming release at regular cadence. |
None |
Anthos clusters on
Description | Severity |
---|---|
A vulnerability was recently discovered in the Linux utility Anthos clusters on AWS are not affected by this vulnerability:
What should I do?Because Anthos clusters on AWS clusters are not affected by this vulnerability, no further action is required. Anthos clusters on AWS will have the patch for this vulnerability applied in a coming release at regular cadence. |
None |
Anthos clusters on
Description | Severity |
---|---|
A vulnerability was recently discovered in the Linux utility Anthos on bare metal clusters are not affected by this vulnerability:
What should I do?Because Anthos on bare metal clusters are not affected by this vulnerability, no further action is required. Anthos on bare metal will have the patch for this vulnerability applied in a coming release at regular cadence. |
None |
GCP-2020-015
Published: 2020-12-07Updated: 2021-12-22
Reference: CVE-2020-8554
2021-12-22 update: Uses gcloud beta
instead of the
gcloud
command.
2021-12-15 update: Added additional mitigate for GKE.
GKE
Description | Severity |
---|---|
Updated: 2021-12-22 The command for GKE in the following section
should use gcloud beta instead of the gcloud command.
gcloud beta container clusters update –no-enable-service-externalips Updated: 2021-12-15 For GKE, the following mitigation is now available:
For more information, see Hardening your cluster's security. The Kubernetes project recently discovered a new security vulnerability, CVE-2020-8554, that might allow an attacker who has obtained permissions to create a Kubernetes Service of type LoadBalancer or ClusterIP to intercept network traffic originating from other Pods in the cluster. This vulnerability by itself does not give an attacker permissions to create a Kubernetes Service. All Google Kubernetes Engine (GKE) clusters are affected by this vulnerability. What should I do?Kubernetes might need to make backwards incompatible design changes in a future version to address the vulnerability. If many users share access to your cluster with permissions to create Services, such as in a multi-tenant cluster, consider applying a mitigation in the meantime. For now, the best approach for mitigation is to restrict the use of ExternalIPs in a cluster. ExternalIPs are not a commonly used feature. Restrict the use of ExternalIPs in a cluster with one of the following methods:
As mentioned in the
Kubernetes announcement,
no mitigation is provided for Services of type LoadBalancer because, by default, only highly
privileged users and system components are granted the |
Medium |
Anthos clusters on
Description | Severity |
---|---|
Updated: 2021-12-22 The command for GKE in the following section
should use gcloud beta instead of the gcloud command.
gcloud beta container clusters update –no-enable-service-externalips Updated: 2021-12-15 For GKE, the following mitigation is now available:
For more information, see Hardening your cluster's security. The Kubernetes project recently discovered a new security vulnerability, CVE-2020-8554, that might allow an attacker who has obtained permissions to create a Kubernetes Service of type LoadBalancer or ClusterIP to intercept network traffic originating from other Pods in the cluster. This vulnerability by itself does not give an attacker permissions to create a Kubernetes Service. All Anthos clusters on VMware are affected by this vulnerability. What should I do?Kubernetes might need to make backwards incompatible design changes in a future version to address the vulnerability. If many users share access to your cluster with permissions to create Services, such as in a multi-tenant cluster, consider applying a mitigation in the meantime. For now, the best approach for mitigation is to restrict the use of ExternalIPs in a cluster. ExternalIPs are not a commonly used feature. Restrict the use of ExternalIPs in a cluster with one of the following methods:
As mentioned in the
Kubernetes announcement,
no mitigation is provided for Services of type LoadBalancer because, by default, only highly
privileged users and system components are granted the |
Medium |
Anthos clusters on
Description | Severity |
---|---|
Updated: 2021-12-22 The command for GKE in the following section
should use gcloud beta instead of the gcloud command.
gcloud beta container clusters update –no-enable-service-externalips Updated: 2021-12-15 For GKE, the following mitigation is now available:
For more information, see Hardening your cluster's security. The Kubernetes project recently discovered a new security vulnerability, CVE-2020-8554, that might allow an attacker who has obtained permissions to create a Kubernetes Service of type LoadBalancer or ClusterIP to intercept network traffic originating from other Pods in the cluster. This vulnerability by itself does not give an attacker permissions to create a Kubernetes Service. All Anthos clusters on AWS are affected by this vulnerability. What should I do?Kubernetes might need to make backwards incompatible design changes in a future version to address the vulnerability. If many users share access to your cluster with permissions to create Services, such as in a multi-tenant cluster, consider applying a mitigation in the meantime. For now, the best approach for mitigation is to restrict the use of ExternalIPs in a cluster. ExternalIPs are not a commonly used feature. Restrict the use of ExternalIPs in a cluster with one of the following methods:
As mentioned in the
Kubernetes announcement,
no mitigation is provided for Services of type LoadBalancer because, by default, only highly
privileged users and system components are granted the |
Medium |
GCP-2020-014
Published: 2020-10-20Reference: CVE-2020-8563, CVE-2020-8564, CVE-2020-8565, CVE-2020-8566
GKE
Updated: 2020-10-20
Description | Severity |
---|---|
The Kubernetes project recently discovered several issues that allow for the exposure of secret data when verbose logging options are enabled. The issues are:
GKE is not affected. What should I do?No further action is required due to the default verbosity logging levels of GKE. |
None |
Anthos clusters on
Updated: 2020-10-10
Description | Severity |
---|---|
The Kubernetes project recently discovered several issues that allow for the exposure of secret data when verbose logging options are enabled. The issues are:
Anthos clusters on VMware is not affected. What should I do?No further action is required due to the default verbosity logging levels of GKE. |
None |
Anthos clusters on
Updated: 2020-10-20
Description | Severity |
---|---|
The Kubernetes project recently discovered several issues that allow for the exposure of secret data when verbose logging options are enabled. The issues are:
Anthos clusters on AWS is not affected. What should I do?No further action is required due to the default verbosity logging levels of GKE. |
None |
GCP-2020-012
Published: 2020-09-14Reference: CVE-2020-14386
GKE
Description | Severity |
---|---|
A vulnerability was recently discovered in the Linux kernel, described in CVE-2020-14386, that may allow container escape to obtain root privileges on the host node. All GKE nodes are affected. Pods running in GKE Sandbox are not able to leverage this vulnerability. What should I do?To fix this vulnerability, upgrade your control plane, and then your nodes to one of the patched versions listed below:
Exploiting this vulnerability requires Drop the
What vulnerability is addressed by this patch?The patch mitigates the following vulnerability: The vulnerability CVE-2020-14386,
which allows containers with |
High |
Anthos clusters on
Updated: 2020-09-17
Description | Severity |
---|---|
A vulnerability was recently discovered in the Linux kernel, described in CVE-2020-14386, that may allow container escape to obtain root privileges on the host node. All Anthos clusters on VMware nodes are affected. What should I do?To fix this vulnerability, upgrade your cluster to a patched version. The following upcoming {gke_on_prem_name}} versions will contain the fix for this vulnerability, and this bulletin will be updated when they are available:
Exploiting this vulnerability requires Drop the
What vulnerability is addressed by this patch?The patch mitigates the following vulnerability: The vulnerability CVE-2020-14386,
which allows containers with |
High |
Anthos clusters on
Updated: 2020-10-13
Description | Severity |
---|---|
A vulnerability was recently discovered in the Linux kernel, described in CVE-2020-14386, that may allow container escape to obtain root privileges on the host node. All Anthos clusters on AWS nodes are affected. What should I do?To fix this vulnerability, upgrade your management service and your user clusters to a patched version. The following upcoming Anthos clusters on AWS versions or newer will include the fix for this vulnerability, and this bulletin will be updated when they are available:
Drop the
What vulnerability is addressed by this patch?The patch mitigates the following vulnerability: The vulnerability CVE-2020-14386,
which allows containers with |
High |
GCP-2020-011
Published: 2020-07-24Reference: CVE-2020-8558
GKE
Description | Severity |
---|---|
A networking vulnerability, CVE-2020-8558, was recently discovered in Kubernetes. Services sometimes communicate with other applications running inside the same Pod using the local loopback interface (127.0.0.1). This vulnerability allows an attacker with access to the cluster's network to send traffic to the loopback interface of adjacent Pods and nodes. Services that rely on the loopback interface not being accessible outside their Pod could be exploited. Exploiting this vulnerability on GKE clusters requires an attacker to have network administrator privileges on the Google Cloud hosting the cluster's VPC. This vulnerability alone does not give an attacker network administrator privileges. For this reason, this vulnerability has been assigned a Low severity for GKE. What should I do?To fix this vulnerability, upgrade your cluster's node pools to the following GKE versions (and later):
What vulnerability is addressed by this patch?This patch fixes the following vulnerability: CVE-2020-8558. |
Low |
Anthos clusters on
Description | Severity |
---|---|
A networking vulnerability, CVE-2020-8558, was recently discovered in Kubernetes. Services sometimes communicate with other applications running inside the same Pod using the local loopback interface (127.0.0.1). This vulnerability allows an attacker with access to the cluster's network to send traffic to the loopback interface of adjacent Pods and nodes. Services that rely on the loopback interface not being accessible outside their Pod could be exploited. What should I do?To fix this vulnerability, upgrade your cluster to a patched version. The following upcoming Anthos clusters on VMware versions or newer contain the fix for this vulnerability:
What vulnerability is addressed by this patch?This patch fixes the following vulnerability: CVE-2020-8558. |
Medium |
Anthos clusters on
Description | Severity |
---|---|
A networking vulnerability, CVE-2020-8558, was recently discovered in Kubernetes. Services sometimes communicate with other applications running inside the same Pod using the local loopback interface (127.0.0.1). This vulnerability allows an attacker with access to the cluster's network to send traffic to the loopback interface of adjacent Pods and nodes. Services that rely on the loopback interface not being accessible outside their Pod could be exploited. Exploiting this vulnerability on user clusters requires an attacker to disable
source destination checks
on the EC2 instances in the cluster. This requires the attacker to have AWS IAM permissions
for What should I do?To fix this vulnerability, upgrade your cluster to a patched version. The following upcoming Anthos clusters on AWS versions or newer are expected to include the fix for this vulnerability:
What vulnerability is addressed by this patch?This patch fixes the following vulnerability: CVE-2020-8558. |
Low |
GCP-2020-009
Published: 2020-07-15Reference: CVE-2020-8559
GKE
Description | Severity |
---|---|
A privilege escalation vulnerability, CVE-2020-8559, was recently discovered in Kubernetes. This vulnerability allows an attacker that has already compromised a node to execute a command in any Pod in the cluster. The attacker can thereby use the already compromised node to compromise other nodes and potentially read information, or cause destructive actions. Note that for an attacker to exploit this vulnerability, a node in your cluster must have already been compromised. This vulnerability, by itself, will not compromise any nodes in your cluster. What should I do?Upgrade your cluster to a patched version. Clusters will be auto-upgraded over the next weeks, and patched versions will be available by July 19, 2020 for an accelerated manual upgrade schedule. The following GKE control plane versions or newer contain the fix for this vulnerability:
What vulnerability is addressed by this patch?These patches mitigate vulnerability CVE-2020-8559. This is rated as a Medium vulnerability for GKE, as it requires the attacker to have first hand information about the cluster, nodes, and workloads to effectively leverage this attack in addition to an existing compromised node. This vulnerability by itself will not provide an attacker with a compromised node. |
Medium |
Anthos clusters on
Description | Severity |
---|---|
A privilege escalation vulnerability, CVE-2020-8559, was recently discovered in Kubernetes. This vulnerability allows an attacker that has already compromised a node to execute a command in any Pod in the cluster. The attacker can thereby use the already compromised node to compromise other nodes and potentially read information, or cause destructive actions. Note that for an attacker to exploit this vulnerability, a node in your cluster must have already been compromised. This vulnerability, by itself, will not compromise any nodes in your cluster. What should I do?Upgrade your cluster to a patched version. The following upcoming Anthos clusters on VMware versions or newer contain the fix for this vulnerability:
What vulnerability is addressed by this patch?These patches mitigate vulnerability CVE-2020-8559. This is rated as a Medium vulnerability for GKE, as it requires the attacker to have first hand information about the cluster, nodes, and workloads to effectively leverage this attack in addition to an existing compromised node. This vulnerability by itself will not provide an attacker with a compromised node. |
Medium |
Anthos clusters on
Description | Severity |
---|---|
A privilege escalation vulnerability, CVE-2020-8559, was recently discovered in Kubernetes. This vulnerability allows an attacker that has already compromised a node to execute a command in any Pod in the cluster. The attacker can thereby use the already compromised node to compromise other nodes and potentially read information, or cause destructive actions. Note that for an attacker to exploit this vulnerability, a node in your cluster must have already been compromised. This vulnerability, by itself, will not compromise any nodes in your cluster. What should I do?Anthos clusters on AWS GA (1.4.1, available end of July, 2020) or newer includes the patch for this vulnerability. If you are using a previous version, download a new version of the anthos-gke command line tool and recreate your management and user clusters. What vulnerability is addressed by this patch?These patches mitigate vulnerability CVE-2020-8559. This is rated as a Medium vulnerability for GKE, as it requires the attacker to have first hand information about the cluster, nodes, and workloads to effectively leverage this attack in addition to an existing compromised node. This vulnerability by itself will not provide an attacker with a compromised node. |
Medium |
GCP-2020-007
Published: 2020-06-01Reference: CVE-2020-8555
GKE
Description | Severity |
---|---|
Server Side Request Forgery (SSRF) vulnerability, CVE-2020-8555, was recently discovered in Kubernetes, allowing certain authorized users to leak up to 500 bytes of sensitive information from the control plane host network. The Google Kubernetes Engine (GKE) control plane uses controllers from Kubernetes and is thus affected by this vulnerability. We recommend that you upgrade the control plane to the latest patch version, as we detail below. A node upgrade is not required. What should I do?For most customers, no further action is required. The vast majority of clusters are already running a patched version. The following GKE versions or newer contain the fix for this vulnerability:
Clusters using release channels are already on control plane versions with the mitigation. What vulnerability is addressed by this patch?These patches mitigate vulnerability CVE-2020-8555. This is rated as a Medium vulnerability for GKE as it was difficult to exploit due to various control plane hardening measures. An attacker with permissions to create a Pod with certain
built-in Volume types (GlusterFS, Quobyte, StorageFS, ScaleIO) or
permissions to create a StorageClass can cause
Combined with a means to leak the results of the |
Medium |
Anthos clusters on
Description | Severity |
---|---|
Server Side Request Forgery (SSRF) vulnerability, CVE-2020-8555, was recently discovered in Kubernetes, allowing certain authorized users to leak up to 500 bytes of sensitive information from the control plane host network. The Google Kubernetes Engine (GKE) control plane uses controllers from Kubernetes and is thus affected by this vulnerability. We recommend that you upgrade the control plane to the latest patch version, as we detail below. A node upgrade is not required. What should I do?The following Anthos clusters on VMware (GKE on-prem) versions or newer contain the fix for this vulnerability:
If you are using a previous version, upgrade your existing cluster to a version containing the fix. What vulnerability is addressed by this patch?These patches mitigate vulnerability CVE-2020-8555. This is rated as a Medium vulnerability for GKE as it was difficult to exploit due to various control plane hardening measures. An attacker with permissions to create a Pod with certain
built-in Volume types (GlusterFS, Quobyte, StorageFS, ScaleIO) or
permissions to create a StorageClass can cause
Combined with a means to leak the results of the |
Medium |
Anthos clusters on
Description | Severity |
---|---|
Server Side Request Forgery (SSRF) vulnerability, CVE-2020-8555, was recently discovered in Kubernetes, allowing certain authorized users to leak up to 500 bytes of sensitive information from the control plane host network. The Google Kubernetes Engine (GKE) control plane uses controllers from Kubernetes and is thus affected by this vulnerability. We recommend that you upgrade the control plane to the latest patch version, as we detail below. A node upgrade is not required. What should I do?Anthos clusters on AWS (GKE on AWS) v0.2.0 or newer already includes the patch for this vulnerability. If you are using a previous version, download a new version of the anthos-gke command line tool and recreate your management and user clusters. What vulnerability is addressed by this patch?These patches mitigate vulnerability CVE-2020-8555. This is rated as a Medium vulnerability for GKE as it was difficult to exploit due to various control plane hardening measures. An attacker with permissions to create a Pod with certain
built-in Volume types (GlusterFS, Quobyte, StorageFS, ScaleIO) or
permissions to create a StorageClass can cause
Combined with a means to leak the results of the |
Medium |
GCP-2020-006
Published: 2020-06-01Reference: Kubernetes issue 91507
GKE
Description | Severity |
---|---|
Kubernetes has disclosed a vulnerability that allows a privileged container to redirect node traffic to another container. Mutual TLS/SSH traffic, such as between the kubelet and API server or traffic from applications using mTLS cannot be read or modified by this attack. All Google Kubernetes Engine (GKE) nodes are affected by this vulnerability, and we recommend that you upgrade to the latest patch version, as we detail below. What should I do?To mitigate this vulnerability, upgrade your control plane, and then your nodes to one of the patched versions listed below. Clusters on release channels are already running a patched version on both control plane and nodes:
Very few containers typically require Drop the
What vulnerability is addressed by this patch?The patch mitigate the following vulnerability: The vulnerability described in
Kubernetes issue 91507
|
Medium |
Anthos clusters on
Description | Severity |
---|---|
Kubernetes has disclosed a vulnerability that allows a privileged container to redirect node traffic to another container. Mutual TLS/SSH traffic, such as between the kubelet and API server or traffic from applications using mTLS cannot be read or modified by this attack. All Google Kubernetes Engine (GKE) nodes are affected by this vulnerability, and we recommend that you upgrade to the latest patch version, as we detail below. What should I do?To mitigate this vulnerability for Anthos clusters on VMware (GKE on-prem), upgrade your clusters to the following version or newer:
Very few containers typically require Drop the
What vulnerability is addressed by this patch?The patch mitigate the following vulnerability: The vulnerability described in
Kubernetes issue 91507
|
Medium |
Anthos clusters on
Description | Severity |
---|---|
Kubernetes has disclosed a vulnerability that allows a privileged container to redirect node traffic to another container. Mutual TLS/SSH traffic, such as between the kubelet and API server or traffic from applications using mTLS cannot be read or modified by this attack. All Google Kubernetes Engine (GKE) nodes are affected by this vulnerability, and we recommend that you upgrade to the latest patch version, as we detail below. What should I do?Download the anthos-gke command line tool with the following version or newer and recreate your management and user clusters:
Very few containers typically require Drop the
What vulnerability is addressed by this patch?The patch mitigate the following vulnerability: The vulnerability described in
Kubernetes issue 91507
|
Medium |
GCP-2020-005
Published: 2020-05-07Updated: 2020-05-07
Reference: CVE-2020-8835
GKE
Description | Severity |
---|---|
A vulnerability was recently discovered in the Linux kernel, described in CVE-2020-8835, allowing container escape to obtain root privileges on the host node. Google Kubernetes Engine (GKE) Ubuntu nodes running GKE 1.16 or 1.17 are affected by this vulnerability, and we recommend that you upgrade to the latest patch version as soon as possible, as we detail below. Nodes running Container-Optimized OS are not affected. Nodes running on Anthos clusters on VMware are not affected. What should I do?For most customers, no further action is required. Only nodes running Ubuntu in GKE version 1.16 or 1.17 are affected. In order to upgrade your nodes, you must first upgrade your master to the newest version. This patch will be available in Kubernetes 1.16.8-gke.12, 1.17.4-gke.10, and newer releases. Track the availability of these patches in the release notes. What vulnerability is addressed by this patch?The patch mitigates the following vulnerability: CVE-2020-8835 describes a vulnerability in the Linux kernel version 5.5.0 and newer that allows a malicious container to (with minimal user interaction in the form of an exec) read and write kernel memory and thus gain root-level code execution on the host node. This is rated as a 'High' severity vulnerability. |
High |
GCP-2020-004
Published: 2020-05-07Updated: 2020-05-07
Reference: CVE-2019-11254
Anthos clusters on
Description | Severity |
---|---|
A vulnerability was recently discovered in Kubernetes, described in CVE-2019-11254, which allows any user authorized to make POST requests to execute a remote Denial-of-Service attack on a Kubernetes API server. The Kubernetes Product Security Committee (PSC) released additional information on this vulnerability which can be found here. You can mitigate this vulnerability by limiting which clients have network access to your Kubernetes API servers. What should I do?We recommend that you upgrade your clusters to patch versions containing the fix for this vulnerability as soon as they are available. The patch versions which contain the fix are listed below:
What vulnerabilities are addressed by this patch?The patch fixes the following Denial-of-Service (DoS) vulnerability: |
Medium |
GCP-2020-003
Published: 2020-03-31Updated: 2020-03-31
Reference: CVE-2019-11254
GKE
Description | Severity |
---|---|
A vulnerability was recently discovered in Kubernetes, described in CVE-2019-11254, which allows any user authorized to make POST requests to execute a remote Denial-of-Service attack on a Kubernetes API server. The Kubernetes Product Security Committee (PSC) released additional information on this vulnerability which can be found here. GKE Clusters that use Master Authorized Networks and Private clusters with no public endpoint mitigate this vulnerability. What should I do?We recommend that you upgrade your cluster to a patch version containing the fix for this vulnerability. The patch versions which contain the fix are listed below:
|