CVE-2022-3162 Unauthorized read of Custom Resources
Users with cluster-wide list permissions on one custom resource can read unauthorized custom resources in the same API group.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3162?
CVE-2022-3162 is a medium-severity missing authorization vulnerability in Kubernetes Kubernetes, published on 1 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
Which versions are affected by CVE-2022-3162?
9 open source packages ship an affected version, including github.com/kubernetes/kubernetes and k8s.io/kubernetes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kubernetes/kubernetes Go | From 1.22.0 | 1.22.16 |
github.com/kubernetes/kubernetes Go | From 1.22.0 | 1.22.16 |
github.com/kubernetes/kubernetes Go | From 1.23.0 | 1.23.14 |
github.com/kubernetes/kubernetes Go | From 1.23.0 | 1.23.14 |
github.com/kubernetes/kubernetes Go | From 1.24.0 | 1.24.8 |
github.com/kubernetes/kubernetes Go | From 1.24.0 | 1.24.8 |
3 more packages
github.com/kubernetes/kubernetes Go | From 1.25.0 | 1.25.4 |
github.com/kubernetes/kubernetes Go | From 1.25.0 | 1.25.4 |
k8s.io/kubernetes Go | From 1.22.0 | 1.22.16, 1.23.14, 1.24.8, 1.25.4 |
Linux distribution packages (4)
microshift Red Hat:openshift:4.12::el8 | All versions | 0:4.12.4-202302151633.p0.gb9fe8ac.assembly.4.12.4.el8 |
microshift-networking Red Hat:openshift:4.12::el8 | All versions | 0:4.12.4-202302151633.p0.gb9fe8ac.assembly.4.12.4.el8 |
microshift-release-info Red Hat:openshift:4.12::el8 | All versions | 0:4.12.4-202302151633.p0.gb9fe8ac.assembly.4.12.4.el8 |
microshift-selinux Red Hat:openshift:4.12::el8 | All versions | 0:4.12.4-202302151633.p0.gb9fe8ac.assembly.4.12.4.el8 |
Products include Kubernetes Kubernetes.
How do I fix CVE-2022-3162?
Upgrade github.com/kubernetes/kubernetes to a fixed version for your release line: 1.22.16, 1.23.14, 1.24.8 or 1.25.4.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-3162 being exploited?
There is no known exploitation of CVE-2022-3162 in the wild and no public exploit code.
Other vulnerabilities in Kubernetes Kubernetes
- CVE-2018-1002105 Privilege Escalation in Kubernetes
- CVE-2017-1000056 Kubernetes Privilege Escalation
- CVE-2016-1906 Authorization bypass in Openshift
- CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
- CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
Sources
Also known as AZL-13780, AZL-13781, AZL-13782, AZL-13783, AZL-25938, AZL-31287 and 5 more.