CVE-2019-11244 kubectl creates world-writeable cached schema files
kubectl writes cached schema files with world-writeable permissions, allowing local attackers to modify them and disrupt kubectl operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11244?
CVE-2019-11244 is a low-severity vulnerability in Kubernetes Kubernetes, published on 22 Apr 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
Which versions are affected by CVE-2019-11244?
2 open source packages ship an affected version, including k8s.io/client-go. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/client-go Go | From 1.8.0 | 1.12.9 |
k8s.io/client-go Go | From 1.8.0 | 1.12.9 |
Linux distribution packages (21)
atomic-openshift Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-clients Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-clients-redistributable Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-docker-excluder Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-excluder Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-hyperkube Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-hypershift Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-master Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-node Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-pod Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-sdn-ovs Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-template-service-broker Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
atomic-openshift-tests Red Hat:openshift:3.11::el7 | All versions | 0:3.11.161-1.git.0.4ccbe25.el7 |
openshift Red Hat:openshift:4.1::el7 | All versions | 0:4.1.24-201911080309.git.0.c41acf2.el7 |
openshift-clients Red Hat:openshift:4.1::el7 | All versions | 0:4.1.24-201911080309.git.0.c41acf2.el7 |
openshift-clients-redistributable Red Hat:openshift:4.1::el7 | All versions | 0:4.1.24-201911080309.git.0.c41acf2.el7 |
openshift-hyperkube Red Hat:openshift:4.1::el7 | All versions | 0:4.1.24-201911080309.git.0.c41acf2.el7 |
openshift Red Hat:openshift:4.1::el8 | All versions | 0:4.1.24-201911080309.git.0.c41acf2.el8 |
openshift-clients Red Hat:openshift:4.1::el8 | All versions | 0:4.1.24-201911080309.git.0.c41acf2.el8 |
openshift-clients-redistributable Red Hat:openshift:4.1::el8 | All versions | 0:4.1.24-201911080309.git.0.c41acf2.el8 |
openshift-hyperkube Red Hat:openshift:4.1::el8 | All versions | 0:4.1.24-201911080309.git.0.c41acf2.el8 |
Products include Kubernetes Kubernetes, Netapp Trident, Redhat Openshift Container Platform.
How do I fix CVE-2019-11244?
Upgrade k8s.io/client-go to 1.12.9 or later.
Is CVE-2019-11244 being exploited?
There is no known exploitation of CVE-2019-11244 in the wild and no public exploit code.
Other vulnerabilities in Kubernetes Kubernetes
- CVE-2018-1002105 Privilege Escalation in Kubernetes
- CVE-2017-1000056 Kubernetes Privilege Escalation
- CVE-2016-1906 Authorization bypass in Openshift
- CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
- CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
Sources
Also known as GHSA-2575-pghm-6qqx, RHSA-2019:3942, RHSA-2020:0020.