CVE-2023-32186 RKE2 supervisor port is vulnerable to unauthenticated remote denial-of-service (DoS) attack via TLS SAN stuffing attack
Attackers with network access to the API server port can cause a denial of service in SUSE RKE2 by exhausting resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-32186?
CVE-2023-32186 is a high-severity denial of service vulnerability in SUSE RKE2, published on 19 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supervisor port (TCP 6443) cause denial of service. This issue affects RKE2: from 1.24.0 before 1.24.17+rke2r1, from v1.25.0 before v1.25.13+rke2r1, from v1.26.0 before v1.26.8+rke2r1, from v1.27.0 before v1.27.5+rke2r1, from v1.28.0 before v1.28.1+rke2r1.
Weakness: CWE-770
Which versions are affected by CVE-2023-32186?
10 open source packages ship an affected version, including github.com/rancher/rke2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rancher/rke2 Go | All versions | 1.24.17 |
github.com/rancher/rke2 Go | All versions | 1.24.17 |
github.com/rancher/rke2 Go | From 1.25.0 | 1.25.13 |
github.com/rancher/rke2 Go | From 1.25.0 | 1.25.13 |
github.com/rancher/rke2 Go | From 1.26.0 | 1.26.8 |
github.com/rancher/rke2 Go | From 1.26.0 | 1.26.8 |
4 more packages
github.com/rancher/rke2 Go | From 1.27.0 | 1.27.5 |
github.com/rancher/rke2 Go | From 1.27.0 | 1.27.5 |
github.com/rancher/rke2 Go | From 1.28.0 | 1.28.1 |
github.com/rancher/rke2 Go | From 1.28.0 | 1.28.1 |
Products include Suse Rancher Rke2.
How do I fix CVE-2023-32186?
Upgrade github.com/rancher/rke2 to a fixed version for your release line: 1.24.17, 1.25.13, 1.26.8 or 1.27.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-32186 being exploited?
There is no known exploitation of CVE-2023-32186 in the wild and no public exploit code.
Sources
Also known as GHSA-p45j-vfv5-wprq.