Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability (CVE-2021-25742)

Summary

IBM Cloud Kubernetes Service is affected by a Kubernetes Ingress Controller security vulnerability where a user that can create or update Ingress objects can use the custom snippets feature to obtain all secrets in the cluster (CVE-2021-25742).

This vulnerability is relevant mainly in multi-tenant environments where non-admin users have permissions to create Ingress objects.

Vulnerability Details

CVEID: CVE-2021-25742
Description: Kubernetes NGINX Ingress Controller could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the custom snippets feature. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain all secrets in the cluster, and use this information to launch further attacks against the affected system.
CVSS Base Score: 7.6
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/211838&gt; for more information
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Affected Products and Versions

IBM Cloud Kubernetes Service clusters with Kubernetes Ingress application load balancers (ALBs) with versions:

• <= 0.48.1_1698_iks
• 1.0.0_1699_iks

Remediation/Fixes

Updates for ALBs are available that fix this vulnerability. By default, automatic updates to Ingress ALBs are enabled, therefore ALBs are automatically updated by IBM when a new default image version is available.

Use the following IBM Cloud CLI command to see the version of your ALBs:

ibmcloud ks ingress alb ls

If the versions are at one of the following versions or later, the ALBs have the fix:

• 1.0.3_1730_iks
• 0.49.3_1745_iks

If automatic updates for the Ingress ALBs are disabled, you can force a one-time update of your ALBs with the following command:

ibmcloud ks ingress alb update

After you force a one-time update, automatic updates remain disabled, but can be re-enabled with the command:

ibmcloud ks ingress alb autoupdate enable

The new versions provide a new configuration parameter (allow-snippet-annotations) which allows clusters administrators to disable the custom snippets feature.

When when the custom snippets feature is disabled, the nginx.ingress.kubernetes.io/configuration-snippet and nginx.ingress.kubernetes.io/server-snippet annotations will be ignored by the ALBs.

Action Required:

Customers must:

1. update to one of the listed Kubernetes Ingress ALB versions
2. validate the Ingress configurations before disabling the featureNote
3. update the controller’s ConfigMap (kube-system/ibm-k8s-controller-config) with allow-snippet-annotations: "false".

Note:

The IBM Cloud ALB OAuth Proxy add-on creates Ingress resources with nginx.ingress.kubernetes.io/configuration-snippet annotation, therefore the allow-snippet-annotations: "false" configuration to remediate this vulnerability is incompatible with the add-on.

Monitor IBM Cloud Status for Future Security Bulletins

Monitor the security notifications on the IBM Cloud Status page to be advised of future security bulletins.

References

Complete CVSS v3 Guide
On-line Calculator v3

Off

Kubernetes ingress-nginx CVE-2021-25742

Related Information

IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

Disclaimer

Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.

Internal Use Only

Requested assistance with the content on https://github.ibm.com/alchemy-containers/armada-frontdoor/issues/5751#issuecomment-36837534

[{“Business Unit”:{“code”:“BU059”,“label”:“IBM Software w/o TPS”},“Product”:{“code”:“SSJTBP”,“label”:“IBM Cloud Kubernetes Service and Red Hat OpenShift on IBM Cloud”},“Component”:“–”,“Platform”:[{“code”:“PF025”,“label”:“Platform Independent”}],“Version”:“All Versions”,“Edition”:“”,“Line of Business”:{“code”:“LOB21”,“label”:“Public Cloud Platform”}}]