CVE-2022-31078 KubeEdge CloudCore Router memory exhaustion
An authenticated attacker can cause CloudCore denial of service by triggering memory exhaustion via large HTTP responses in the router module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31078?
CVE-2022-31078 is a medium-severity denial of service vulnerability in kubeedge, published on 11 Jul 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made by the REST handler. An attacker could use this weakness to make a request that will return an HTTP response with a large body and cause DoS of CloudCore. In the HTTP Handler API, the rest handler makes a request to a pre-specified handle. The handle will return an HTTP response that is then read into memory. The consequence of the exhaustion is that CloudCore will be in a denial of service. Only an authenticated user of the cloud can make an attack. It will be affected only when users enable `router` module in the config file `cloudcore.yaml`. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable the router switch in the config file `cloudcore.yaml`.
Which versions are affected by CVE-2022-31078?
7 open source packages ship an affected version, including github.com/kubeedge/kubeedge. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kubeedge/kubeedge Go | All versions | 1.9.4, 1.10.2, 1.11.1 |
github.com/kubeedge/kubeedge Go | All versions | 1.9.4 |
github.com/kubeedge/kubeedge Go | All versions | 1.9.4 |
github.com/kubeedge/kubeedge Go | From 1.10.0 | 1.10.2 |
github.com/kubeedge/kubeedge Go | From 1.10.0 | 1.10.2 |
github.com/kubeedge/kubeedge Go | From 1.11.0 | 1.11.1 |
1 more packages
github.com/kubeedge/kubeedge Go | From 1.11.0 | 1.11.1 |
Products include Linuxfoundation Kubeedge.
How do I fix CVE-2022-31078?
Upgrade github.com/kubeedge/kubeedge to a fixed version for your release line: 1.9.4, 1.10.2 or 1.11.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-31078 being exploited?
There is no known exploitation of CVE-2022-31078 in the wild and no public exploit code.
Other vulnerabilities in kubeedge
- CVE-2022-31073 KubeEdge Edge ServiceBus module DoS
- CVE-2022-31075 KubeEdge DoS when signing the CSR from EdgeCore
- CVE-2022-31074 KubeEdge Cloud AdmissionController component DoS
- CVE-2022-31079 KubeEdge Cloud Stream and Edge Stream DoS from large stream message
- CVE-2022-31080 KubeEdge Websocket Client in package Viaduct: DoS from large response message
Sources
Also known as GHSA-qpx3-9565-5xwm, GO-2022-0510.