Security Bulletin
Summary
IBM Cloud Kubernetes Service is affected by a Kubernetes security vulnerability that could allow a malicious user to intercept traffic from other pods or nodes in the cluster (CVE-2020-8554)
Vulnerability Details
CVEID: CVE-2020-8554
Description: Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when using LoadBalancer or ExternalIPs. By using man-in-the-middle attack techniques, an attacker could exploit this vulnerability to patch the status of a LoadBalancer service.
CVSS Base Score: 6.3
CVSS Temporal Score: https://exchange.xforce.ibmcloud.com/vulnerabilities/192721 for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Affected Products and Versions
Remediation/Fixes
Workarounds and Mitigations
You can mitigate this vulnerability by using Kubernetes role-based access control (RBAC) to limit the users authorized to create and update Kubernetes services. You can further mitigate this vulnerability by controlling network traffic for classic or VPC clusters. Refer to the Kubernetes security advisory CVE-2020-8554: Man in the middle using LoadBalancer or ExternalIPs for more information on this vulnerability along with options for restricting the use of external IPs. Be sure to review Accessing the cluster master via admission controllers and webhooks if you deploy a webhook to your cluster. Refer to the Tigera blog New Vulnerability Exposes Kubernetes to Man-in-the-Middle Attacks: How to Mitigate CVE-2020-8554 for more information on this vulnerability and an overview of how network policies can be used to mitigate this vulnerability. Note that IBM Cloud Kubernetes Service does not support Calico Enterprise.
You can monitor your cluster for external IP usages by running the following command:
kubectl get svc --all-namespaces -o go-template='
{{- range .items -}}
{{if .spec.externalIPs -}}
{{.metadata.namespace}}/{{.metadata.name}}: {{.spec.externalIPs}}{{"\n"}}
{{- end}}
{{- end -}}
'
You are encouraged to enable Kubernetes API server auditing to monitor your cluster for evidence of this vulnerability being exploited.
Monitor IBM Cloud Status for Future Security Bulletins
Monitor the security notifications on the IBM Cloud Status page to be advised of future security bulletins.
References
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
Document Information
Modified date:
11 June 2021
UID
ibm16428013