Bug 1167508 (CVE-2020-8552)

Summary: VUL-0: CVE-2020-8552: kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion
Product: [Novell Products] SUSE Security Incidents Reporter: Robert Frohl <rfrohl>
Component: IncidentsAssignee: Jordi Massaguer <jmassaguerpla>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: aojeagarcia, atoptsoglou, rbrown, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/255609/
Whiteboard: CVSSv2:NVD:CVE-2020-8552:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv3.1:NVD:CVE-2020-8552:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSSv3.1:RedHat:CVE-2020-8552:4.3:(AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Robert Frohl 2020-03-24 07:39:46 UTC
rh#1797909

A flaw was found in the Kubernetes API server that allows for memory exhaustion and subsequent denial of service. A label in a Kubernetes apiserver metric that reflects the client's user agent is included for debugging purposes, but every value added adds a sustained memory overhead as the metric is now tracked. This is particularly dangerous on commonly unauthenticated APIs (selfsubjectaccessreview for example) and can be performed by any authenticated user.


Upstream Fixes:

1.18: https://github.com/kubernetes/kubernetes/pull/87669
1.17: https://github.com/kubernetes/kubernetes/pull/87673
1.16: https://github.com/kubernetes/kubernetes/pull/87681
1.15: https://github.com/kubernetes/kubernetes/pull/87682

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1797909
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8552
http://seclists.org/oss-sec/2020/q1/121
Comment 2 Richard Brown 2020-03-24 16:13:10 UTC
Already fixed in openSUSE Tumbleweed/Kubic - using 1.17.4 there
Comment 3 Jordi Massaguer 2020-04-22 08:43:15 UTC
This will be fixed in 4.2.0 which has k8s 1.17.4
Comment 4 Alexandros Toptsoglou 2020-07-22 09:32:39 UTC
Fixed