PT-2023-24766 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.13.4 Description: The issue arises when Gateway API is enabled in Cilium, allowing an attacker on an affected cluster to leverage the absence of a check on the namespace in which a ReferenceGrant is created. This...

PT-2023-2053 · Rhods · Rhods

Name of the Vulnerable Software and Affected Versions: RHODS affected versions not specified Description: A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can...

CVE-2021-41805

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a different namespace...

DEBIAN-CVE-2021-38209

net/netfilter/nfconntrackstandalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NFSYSCTLCTMAX, NFSYSCTLCTEXPECTMAX, and NFSYSCTLCTBUCKETS sysctls...

atomic-openshift: cross-namespace owner references can trigger deletions of valid children

A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects...

PT-2020-17327 · Hashicorp · Hashicorp Vault Enterprise

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault Enterprise versions prior to 1.5.6 HashiCorp Vault Enterprise versions prior to 1.6.1 Description: The issue concerns HashiCorp Vault Enterprise's Sentinel EGP policy feature, which incorrectly allowed requests to be processed...

Consul Enterprise Namespace Config Entry Replication Denial of Service

Summary Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause infinite Raft writes. This vulnerability, CVE-2020-25201, was fixed in 1.7.9 and 1.8.5. Background Consul Enterprise namespaces enable organizational multi-tenancy so that...

kernel: nfs: use-after-free in svc_process_common()

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bcsvcprocess use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and ...

kernel: nfs: use-after-free in svc_process_common()

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bcsvcprocess use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and ...

PT-2019-16753 · Red Hat · Atomic-Openshift

Name of the Vulnerable Software and Affected Versions: atomic-openshift versions 3.6 through 4.1 Description: A flaw in the garbage collection mechanism allows an attacker to spoof the UUID of a valid object from another namespace, enabling them to delete children of those objects. Recommendation...

CVE-2018-16884

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bcsvcprocess use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and ...

Cross Namespace Escalation

github.com/kubernetes/kubernetes is vulnerable to cross namespace escalation attacks. A malicious user can submit a HPA request against another namespace that they have no permissions on and use it to manipulate resources...