Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes security vulnerability (CVE-2020-8554)

Summary

Red Hat OpenShift on IBM Cloud is affected by a Kubernetes security vulnerability that could allow a malicious user to intercept traffic from other pods or nodes in the cluster (CVE-2020-8554)

Vulnerability Details

CVEID: CVE-2020-8554
Description: Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw when using LoadBalancer or ExternalIPs. By using man-in-the-middle attack techniques, an attacker could exploit this vulnerability to patch the status of a LoadBalancer service.
CVSS Base Score: 6.3
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/192721&gt; for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Red Hat OpenShift on IBM Cloud 4.3-4.6
Red Hat OpenShift on IBM Cloud 3.11

Remediation/Fixes

There is no Kubernetes fix for this vulnerability. The vulnerability may only be mitigated by restricting access to the vulnerable Kubernetes feature.

Workarounds and Mitigations

You can mitigate this vulnerability by using Kubernetes role-based access control (RBAC) to limit the users authorized to create and update Kubernetes services. Red Hat OpenShift on IBM Cloud version 4 clusters only allow a cluster admin to create services with an external IP address. You can further mitigate this vulnerability by controlling network traffic for classic or VPC clusters. Refer to the Kubernetes security advisory CVE-2020-8554: Man in the middle using LoadBalancer or ExternalIPs and Red Hat documentation for CVE-2020-8554 for more information on this vulnerability. Note that Red Hat OpenShift on IBM Cloud does not support configuring the external IP addresses ranges. Refer to the Tigera blog New Vulnerability Exposes Kubernetes to Man-in-the-Middle Attacks: How to Mitigate CVE-2020-8554 for more information on this vulnerability and an overview of how network policies can be used to mitigate this vulnerability. Note that Red Hat OpenShift on IBM Cloud does not support Calico Enterprise.

You can monitor your cluster for external IP usages by running the following command:

kubectl get svc --all-namespaces -o go-template='
{{- range .items -}}
  {{if .spec.externalIPs -}}
    {{.metadata.namespace}}/{{.metadata.name}}: {{.spec.externalIPs}}{{"\n"}}
  {{- end}}
{{- end -}}
'

You are encouraged to enable Kubernetes API server auditing to monitor your cluster for evidence of this vulnerability being exploited.

Monitor IBM Cloud Status for Future Security Bulletins

Monitor the security notifications on the IBM Cloud Status page to be advised of future security bulletins.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Kubernetes Security Announcement for CVE-2020-8554

Red Hat documentation for CVE-2020-8554
Tigera blog entry to mitigate CVE-2020-8554

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

[{“Business Unit”:{“code”:“BU059”,“label”:“IBM Software w/o TPS”},“Product”:{“code”:“SSJTBP”,“label”:“IBM Cloud Kubernetes Service”},“Component”:“–”,“Platform”:[{“code”:“PF025”,“label”:“Platform Independent”}],“Version”:“All Versions”,“Edition”:“”,“Line of Business”:{“code”:“LOB21”,“label”:“Public Cloud Platform”}}]