TencentOS Server 4: kubernetes (TSSA-2024:0872)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2024:0872.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(239505);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/04");

  script_cve_id(
    "CVE-2021-25749",
    "CVE-2022-3172",
    "CVE-2022-3294",
    "CVE-2023-2431",
    "CVE-2023-2727",
    "CVE-2023-2728"
  );

  script_name(english:"TencentOS Server 4: kubernetes (TSSA-2024:0872)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 4 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0872 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2021-25749:
    Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option
    to true.

    CVE-2022-3172:
    A security issue was discovered in kube-apiserver that allows an
    aggregated API server to redirect client traffic to any URL.  This could
     lead to the client performing unexpected actions as well as forwarding
    the client's API server credentials to third parties.

    CVE-2022-3294:
    Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only
    affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports
    node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish
    connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying
    address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this
    validation could allow authenticated requests destined for Nodes to to the API server/'s private network.

    CVE-2023-2431:
    A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement.
    Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this
    issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode.
    This bug affects Kubelet.

    CVE-2023-2728:
    Users may be able to launch containers that bypass the mountable secrets policy enforced by the
    ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a
    service account may only reference secrets specified in the service accounts secrets field. Kubernetes
    clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-
    mountable-secrets` annotation are used together with ephemeral containers.

    CVE-2023-2727:
    Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using
    ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is
    used together with ephemeral containers.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20240872.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-3294");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/11/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:kubernetes");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 4.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'kubernetes-1.27.4-6.oc9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-1.27.4-6.oc9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-client-1.27.4-6.oc9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-client-1.27.4-6.oc9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-kubeadm-1.27.4-6.oc9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-kubeadm-1.27.4-6.oc9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-master-1.27.4-6.oc9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-master-1.27.4-6.oc9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-node-1.27.4-6.oc9', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kubernetes-node-1.27.4-6.oc9', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kubernetes / kubernetes-client / kubernetes-kubeadm / etc');
}