CVE-2022-46167 Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace

What is CVE-2022-46167?

CVE-2022-46167 is a high-severity vulnerability in clastix capsule, published on 2 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items. An attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation. Patches have been released for version 0.1.3. No known workarounds are available.

Weakness: CWE-863

Which versions are affected by CVE-2022-46167?

3 open source packages ship an affected version, including github.com/clastix/capsule. It affects 1 product.

Products include Clastix Capsule.

How do I fix CVE-2022-46167?

Upgrade github.com/clastix/capsule to 0.1.3 or later.

Is CVE-2022-46167 being exploited?

There is no known exploitation of CVE-2022-46167 in the wild and no public exploit code.

Other vulnerabilities in clastix capsule

• CVE-2023-46254 Service accounts can see namespaces of other tenants in capsule-proxy Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x45c-cvp8-q4fm, GO-2022-1135.