Access Restriction Bypass Affecting k8s.io/kubernetes/pkg/kubelet/kuberuntime package, versions <1.24.14 >=1.25.0 <1.25.10 >=1.26.0 <1.26.5 >=1.27.0 <1.27.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-K8SIOKUBERNETESPKGKUBELETKUBERUNTIME-5710963
- published 16 Jun 2023
- disclosed 16 Jun 2023
- credit Tim Allclair, Craig Ingram
Introduced: 16 Jun 2023
CVE-2023-2431 Open this link in a new tabHow to fix?
Upgrade k8s.io/kubernetes/pkg/kubelet/kuberuntime to version 1.24.14, 1.25.10, 1.26.5, 1.27.2 or higher.
Overview
k8s.io/kubernetes/pkg/kubelet/kuberuntime is a package that contains an implementation of kubecontainer.
Affected versions of this package are vulnerable to Access Restriction Bypass which allows pods to bypass the seccomp profile enforcement.
Exploiting this vulnerability allows the pod to run in unconfined (seccomp disabled) mode.
Notes:
Only Pods that use localhost type for seccomp profile but specify an empty profile field are affected by this issue. In this scenario, this vulnerability.