8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
IBM Cloud Kubernetes Service is affected by a security vulnerability in runc which could allow an attacker that is authorized to run a process as root inside a container to execute arbitrary commands with root privileges on the container’s host system.
CVE-ID: CVE-2019-5736
Description: Runc could allow a local attacker to execute arbitrary commands on the system, cause by the improper handling of system file descriptors when running containers. An attacker could exploit this vulnerability using a malicious container to overwrite the contents of the host runc binary and execute arbitrary commands with root privileges on the host system.
CVSS Base Score: 7.7
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/156819> for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
All versions of IBM Cloud Kubernetes Service are impacted.
Authenticated users on all versions that are authorized to run a process as root (UID 0) inside a container can exploit the vulnerability in runc. This can be done by running a container with a malicious image, or by any other means by which commands can be executed in a container, for example, kubectl exec. This exploit enables a malicious user to gain root privileges on the host running the container. Containers that cannot run processes as root are not exploitable.
To help mitigate this vulnerability, you are highly encouraged to Configure pod security policies in your cluster to prevent container processes from running as root.
Updates for IBM Cloud Kubernetes Service cluster worker nodes at versions 1.10 and later are available that fix this vulnerability. Customers must update their worker nodes to address the vulnerability. See Updating worker nodes for details on updating worker nodes. To verify your cluster worker nodes have been updated, use the following IBM Cloud CLI command to confirm the currently running version:
ibmcloud ks workers --cluster <cluster name or ID>
If the Kubernetes version is at one of the following patch levels or later the cluster worker node update has completed successfully:
1.10.12_1544
1.11.7_1544
1.12.5_1538
1.13.2_1508
Customers running IBM Cloud Kubernetes Service clusters at versions 1.7, 1.8 or 1.9 must upgrade their affected clusters to version 1.10. See Updating clusters for details on upgrading the cluster master and worker nodes.
Customers running IBM Cloud Kubernetes Service clusters at version 1.5 must create a new cluster and migrate their apps to it.
Note: IBM Cloud Kubernetes Service versions 1.5, 1.7, 1.8 and 1.9 are no longer supported. See the IBM Cloud Kubernetes Service Version information and update actions documentation for more information about Kubernetes versions and version support policies.
CPE | Name | Operator | Version |
---|---|---|---|
ibm cloud kubernetes service | eq | any |
8.6 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C