container uid changes to root after first restart or if image is already pulled to the node

🗓️ 24 May 2019 16:14:49Reported by Kubernetes Security Response CommitteeType

Kubelet 1.13.6/1.14.2 may run containers as root after restart when user controls are absent.

Reporter	Title	Published	Views	Family All 22
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private for Data V2.1.0 NGINX (CVE-2019-12206, CVE-2019-12207, CVE-2019-12208, CVE-2019-20372), Docker (CVE-2019-17149, CVE-2019-17150), Kubernetes (CVE-2019-11245, CVE-2019-11253, CVE-2019-1022	6 Mar 202020:58	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Private Kubernetes (CVE-2019-11245)	30 Dec 201916:06	–	ibm
Circl	CVE-2019-11245	29 Aug 201917:38	–	circl
CNVD	Google Kubernetes Kubelet Elevation of Privilege Vulnerability	2 Sep 201900:00	–	cnvd
CVE	CVE-2019-11245	29 Aug 201900:22	–	cve
Cvelist	CVE-2019-11245 kubelet-started container uid changes to root after first restart or if image is already pulled to the node	29 Aug 201900:22	–	cvelist
Debian CVE	CVE-2019-11245	29 Aug 201900:22	–	debiancve
EUVD	EUVD-2024-1293	3 Oct 202520:07	–	euvd
Github Security Blog	Kubelet Incorrect Privilege Assignment	24 Apr 202420:03	–	github
GitLab Advisory Database	Incorrect Default Permissions	29 Aug 201900:00	–	gitlab

24 May 2019 16:14Current

6.6Medium risk

Vulners AI Score6.6

CVSS 24.6

CVSS 34.9 - 7.8

EPSS0.00599