VulnerabilityAnalyzed
CVE-2023-5528
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes.
HIGH 8.8EPSS 3.58%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.58% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- kubernetes/kubernetes · fedoraproject/fedora
- Source
- jordan@liggitt.net
References
- https://github.com/kubernetes/kubernetes/issues/121879Issue Tracking, Patch
- https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzAMailing List
- https://github.com/kubernetes/kubernetes/issues/121879Issue Tracking, Patch
- https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzAMailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ/Patch, Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7/Patch, Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4/Patch, Release Notes
- https://security.netapp.com/advisory/ntap-20240119-0009/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.