Bug 1167508 - (CVE-2020-8552) VUL-0: CVE-2020-8552: kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion
(CVE-2020-8552)
VUL-0: CVE-2020-8552: kubernetes: Use of unbounded 'client' label in apiserve...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Jordi Massaguer
Security Team bot
https://smash.suse.de/issue/255609/
CVSSv2:NVD:CVE-2020-8552:5.0:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-03-24 07:39 UTC by Robert Frohl
Modified: 2020-07-22 09:32 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2020-03-24 07:39:46 UTC
rh#1797909

A flaw was found in the Kubernetes API server that allows for memory exhaustion and subsequent denial of service. A label in a Kubernetes apiserver metric that reflects the client's user agent is included for debugging purposes, but every value added adds a sustained memory overhead as the metric is now tracked. This is particularly dangerous on commonly unauthenticated APIs (selfsubjectaccessreview for example) and can be performed by any authenticated user.


Upstream Fixes:

1.18: https://github.com/kubernetes/kubernetes/pull/87669
1.17: https://github.com/kubernetes/kubernetes/pull/87673
1.16: https://github.com/kubernetes/kubernetes/pull/87681
1.15: https://github.com/kubernetes/kubernetes/pull/87682

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1797909
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8552
http://seclists.org/oss-sec/2020/q1/121
Comment 2 Richard Brown 2020-03-24 16:13:10 UTC
Already fixed in openSUSE Tumbleweed/Kubic - using 1.17.4 there
Comment 3 Jordi Massaguer 2020-04-22 08:43:15 UTC
This will be fixed in 4.2.0 which has k8s 1.17.4
Comment 4 Alexandros Toptsoglou 2020-07-22 09:32:39 UTC
Fixed