Bug 918665 (CVE-2023-5528)

Summary:	<sys-cluster/kubelet-{1.27.9,1.28.5}: privilege escalation in windows nodes
Product:	Gentoo Security	Reporter:	Christopher Fore <csfore>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	ajak, williamh
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	C1 [glsa+]
Package list:		Runtime testing required:	---

Description Christopher Fore 2023-11-27 17:22:12 UTC

CVE-2023-5528 (https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA)

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

Comment 1 John Helmert III archtester

2023-11-27 18:34:36 UTC

Note that we don't version the summary until there's a fixed version in tree. Thanks for reporting!

William, please bump.

Comment 2 Larry the Git Cow gentoo-dev

2024-05-12 05:13:30 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a1c03996e73527ab24e4930a665991a173efdf7f

commit a1c03996e73527ab24e4930a665991a173efdf7f
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-05-12 05:13:03 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-05-12 05:13:26 +0000

    [ GLSA 202405-31 ] Kubelet: Privilege Escalation
    
    Bug: https://bugs.gentoo.org/918665
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202405-31.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)