Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from a NAPI instance in the netdev module that does not properly handle namespaces. This could lead to cross-namespac...

AZL-57223 CVE-2025-21636 affecting package kernel for versions less than 5.15.180.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtudprobeinterval: avoid using current-nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info fro...

Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Token

Summary Nomad Community and Nomad Enterprise “Nomad” allocations are vulnerable to privilege escalation within a namespace through unredacted workload identity tokens. This vulnerability, identified as CVE-2024-12678, is fixed in Nomad Community Edition 1.9.4 and Nomad Enterprise 1.9.4, 1.8.8, an...

Incorrect Authorization

github.com/hashicorp/nomad is vulnerable to Incorrect Authorization . The vulnerability is due to insufficient validation of CSI volume writes, which allows unauthorized access to create volumes across namespaces...

SUSE CVE-2024-7558

JUJUCONTEXTID is a predictable authentication secret. On a Juju machine non-Kubernetes or Juju charm container on Kubernetes, an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJUCONTEXTID value. This gives the unprivileged user access to t...

Secret Exfiltration

github.com/metal3-io/baremetal-operator is vulnerable to Secret Exfiltration. The vulnerability is due to BMO's ability to read Secrets from any namespace, which allows an attacker to exfiltrate Secrets from other namespaces by linking them to a BareMetalHost configuration...

Bare Metal Operator 安全漏洞

Bare Metal Operator is a Metal³ open source application that uses the Kubernetes API to manage bare metal hosts. A security vulnerability exists in Bare Metal Operator version 0.8.0, version 0.6.2, and versions prior to 0.5.2, which stems from improper cross-namespace key access control and could...

PT-2024-19437 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions 3.6 through 3.6.2.5 Dell ECS versions 3.7 through 3.7.0.6 Dell ECS versions 3.8 through 3.8.0.4 Description: The issue is related to an improper access control vulnerability. A remote high privileged attacker could potential...

Authorization

In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project...

CVE-2023-3027

The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values instead of the policy apply a static manifest on a managed cluster of taking advantage of cluster scoped access in a created policy. This feature...

CVE-2023-3027

The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values instead of the policy apply a static manifest on a managed cluster of taking advantage of cluster scoped access in a created policy. This feature...

amq: AMQ Broker Operator ClusterWide Edit Permissions Due Token Exposure

A flaw was found in AMQ Broker Operator, installed via UI using the OperatorHub. In this vulnerability, a low-privilege user with access to the Operator deployed namespace has access to cluster-wide edit rights. This flaw allows an attacker to have full cluster management access...

In the Linux kernel before 5.17.3 fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This can be triggered by a local user who has no access to any user namespace; however the race condition perhaps can only be exploited infrequently.

...

AZL-9582 CVE-2022-29582 affecting package kernel for versions less than 5.15.37.1-2

In the Linux kernel before 5.17.3, fs/iouring.c has a use-after-free due to a race condition in iouring timeouts. This can be triggered by a local user who has no access to any user namespace; however, the race condition perhaps can only be exploited infrequently...

cri-o: pod with access to 'hostIPC' and 'hostNetwork' kernel namespace allows sysctl from the list of safe sysctls to be applied to the host

An incorrect sysctls validation vulnerability was found in CRI-O. The sysctls from the list of "safe" sysctls specified for the cluster 0 will be applied to the host if an attacker can create a pod with a hostIPC and hostNetwork kernel namespace...

Consul Enterprise Namespace Config Entry Replication Denial of Service

Summary Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause infinite Raft writes. This vulnerability, CVE-2020-25201, was fixed in 1.7.9 and 1.8.5. Background Consul Enterprise namespaces enable organizational multi-tenancy so that...

Vault Enterprise Prefixed Mount Policies May Result In Unauthorized Namespace Access

Summary A vulnerability was identified in Vault Enterprise such that, under certain circumstances, existing nested-path policies may give access to Namespaces created after-the-fact. This vulnerability, CVE-2020-10661, affects Vault Enterprise versions 0.11 and newer and is fixed in 1.3.4...

HashiCorp Vault and Vault Enterprise Unauthorized Access Vulnerability

HashiCorp Vault is a private key access management tool. A security vulnerability exists in the nested path policy in HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3. An attacker could exploit the vulnerability to access namespaces...

PT-2020-6523 · Unknown · Ingress-Nginx

Name of the Vulnerable Software and Affected Versions: ingress-nginx versions prior to 0.28.0 Description: The issue is related to errors in processing hyperlinks in the ingress-nginx controller in a Kubernetes cluster. This can be exploited by a remote attacker to gain access to create, modify, ...

kubernetes: API server allows access to cluster-scoped custom resources as if resources were namespaced

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with...