CVE-2024-0793 Kube-controller-manager: malformed hpa v1 manifest causes crash
A malformed HPA manifest causes kube-controller-manager to crash, leading to denial of service in Kubernetes clusters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-0793?
CVE-2024-0793 is a high-severity denial of service vulnerability in Red Hat OpenShift Container Platform 4, published on 17 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.
Weakness: CWE-20
Which versions are affected by CVE-2024-0793?
3 open source packages ship an affected version, including k8s.io/kubernetes.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | All versions | 1.27.0-alpha.1 |
k8s.io/kubernetes Go | All versions | 1.27.0-alpha.1 |
k8s.io/kubernetes Go | All versions | 1.27.0-alpha.1 |
Linux distribution packages (14)
openshift Red Hat:openshift:4.12::el8 | All versions | 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el8 |
openshift-hyperkube Red Hat:openshift:4.12::el8 | All versions | 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el8 |
openshift Red Hat:openshift:4.12::el9 | All versions | 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el9 |
openshift-hyperkube Red Hat:openshift:4.12::el9 | All versions | 0:4.12.0-202403042037.p0.g9946c63.assembly.stream.el9 |
kubernetes1.23 SUSE:Linux Enterprise Module for Containers 15 SP5 | All versions | 1.23.17-150500.3.9.1 |
kubernetes1.24 SUSE:Linux Enterprise Module for Containers 15 SP5 | All versions | 1.24.17-150500.3.13.1 |
kubernetes1.25 SUSE:Linux Enterprise Module for Containers 15 SP5 | All versions | 1.25.16-150400.9.6.1 |
kubernetes1.26 SUSE:Linux Enterprise Module for Containers 15 SP5 | All versions | 1.26.14-150400.9.6.1 |
kubernetes1.26 SUSE:Linux Enterprise Module for Containers 15 SP6 | All versions | 1.26.14-150400.9.6.1 |
kubernetes1.23 openSUSE:Leap 15.5 | All versions | 1.23.17-150500.3.9.1 |
kubernetes1.24 openSUSE:Leap 15.5 | All versions | 1.24.17-150500.3.13.1 |
kubernetes1.25 openSUSE:Leap 15.5 | All versions | 1.25.16-150400.9.6.1 |
kubernetes1.26 openSUSE:Leap 15.5 | All versions | 1.26.14-150400.9.6.1 |
kubernetes1.26 openSUSE:Tumbleweed | All versions | 1.26.14-1.1 |
How do I fix CVE-2024-0793?
Upgrade k8s.io/kubernetes to 1.27.0-alpha.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-0793 being exploited?
There is no known exploitation of CVE-2024-0793 in the wild and no public exploit code.
Sources
Also known as GHSA-h7wq-jj8r-qm7p, GO-2024-3277, RHSA-2024:1267, SUSE-SU-2024:1163-1, SUSE-SU-2024:1164-1, SUSE-SU-2024:1165-1 and 6 more.