Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2023-2431: Kubernetes Kubelet lets pods skip security profile
CVE-2023-2431 · published 3 years ago
Summary
The Kubelet component in Kubernetes can let containers run without the intended seccomp restrictions when they use a localhost profile but leave the profile field empty. This means the containers can make system calls without limits, increasing the chance of malicious activity. Update Kubelet to a patched version and ensure all pods specify a valid seccomp profile to keep the protection active.
What to do
- Update k8s.io kubernetes to version 1.24.14.
- Update k8s.io kubernetes to version 1.25.10.
- Update k8s.io kubernetes to version 1.26.5.
- Update k8s.io kubernetes to version 1.27.2.
- Update debian kubernetes to version 1.20.5+really1.20.2-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | k8s.io | kubernetes |
< 1.24.14 >= 1.25.0, < 1.25.10 >= 1.26.0, < 1.26.5 >= 1.27.0, < 1.27.2 Fix: upgrade to 1.24.14
|
| – | kubernetes | kubernetes |
< 1.24.14 >= 1.25.0, < 1.25.10 >= 1.26.0, < 1.26.5 >= 1.27.0, < 1.27.2 cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
38 cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
| Debian:12 | debian | kubernetes |
< 1.20.5+really1.20.2-1 Fix: upgrade to 1.20.5+really1.20.2-1
|
Original advisory text
Bypass of seccomp profile enforcement
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
References
- https://github.com/kubernetes/kubernetes/pull/117020
- https://github.com/kubernetes/kubernetes/pull/117116
- https://github.com/kubernetes/kubernetes/pull/117117
- https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10 URL
- https://nvd.nist.gov/vuln/detail/CVE-2023-2431 Vendor Advisory
- https://github.com/kubernetes/kubernetes/issues/118690 Third Party Advisory
- https://github.com/kubernetes/kubernetes/pull/117118
- https://github.com/kubernetes/kubernetes/pull/117147
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://pkg.go.dev/vuln/GO-2023-1864
- https://github.com/advisories/GHSA-xc8m-28vv-4pjc
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://github.com/kubernetes/kubernetes/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2431.j... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2023-2431 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-1287Improper Validation of Specified Type of Input
Timeline
Published16 Jun 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-xc8m-28vv-4pjc · GHSA
CVE-2023-2431 · NVD
CVE-2023-2431 · OSV
DEBIAN-CVE-2023-2431 · OSV
Track software like this
Free during beta