Bug 1167508 – VUL-0: CVE-2020-8552: kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion

Bug 1167508 - (CVE-2020-8552) VUL-0: CVE-2020-8552: kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion

(CVE-2020-8552)
Summary:	VUL-0: CVE-2020-8552: kubernetes: Use of unbounded 'client' label in apiserve...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Jordi Massaguer
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/255609/
Whiteboard:	CVSSv2:NVD:CVE-2020-8552:5.0:(AV:N/A...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2020-03-24 07:39 UTC by Robert Frohl
Modified:	2020-07-22 09:32 UTC (History)
CC List:	4 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Robert Frohl 2020-03-24 07:39:46 UTC

rh#1797909

A flaw was found in the Kubernetes API server that allows for memory exhaustion and subsequent denial of service. A label in a Kubernetes apiserver metric that reflects the client's user agent is included for debugging purposes, but every value added adds a sustained memory overhead as the metric is now tracked. This is particularly dangerous on commonly unauthenticated APIs (selfsubjectaccessreview for example) and can be performed by any authenticated user.


Upstream Fixes:

1.18: https://github.com/kubernetes/kubernetes/pull/87669
1.17: https://github.com/kubernetes/kubernetes/pull/87673
1.16: https://github.com/kubernetes/kubernetes/pull/87681
1.15: https://github.com/kubernetes/kubernetes/pull/87682

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1797909
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8552
http://seclists.org/oss-sec/2020/q1/121

Comment 2 Richard Brown 2020-03-24 16:13:10 UTC

Already fixed in openSUSE Tumbleweed/Kubic - using 1.17.4 there

Comment 3 Jordi Massaguer 2020-04-22 08:43:15 UTC

This will be fixed in 4.2.0 which has k8s 1.17.4

Comment 4 Alexandros Toptsoglou 2020-07-22 09:32:39 UTC

Fixed