Vulnerability in Kubernetes Image Builder Exposes Nodes to Root Access Risk

In the world of container orchestration, Kubernetes remains a powerful tool, but recent developments have highlighted a critical security vulnerability that users need to be aware of. This flaw, tracked as CVE-2024-9486, has a CVSS score of 9.8, making it one of the most severe vulnerabilities disclosed this year. The issue, if exploited, could grant unauthorized users root access to Kubernetes nodes, significantly compromising the security of applications and data hosted within Kubernetes environments.

Understanding the Vulnerability

The Kubernetes Image Builder vulnerability stems from the use of default credentials during the image build process. As outlined in a recent alert from Red Hat’s Joel Smith, the flaw is particularly concerning for users who utilize the Proxmox provider for virtual machine (VM) images. The problem arises because these default credentials remain enabled in images built with the Proxmox provider, potentially allowing unauthorized access to the underlying nodes.

Who is Affected?

It’s crucial to note that only Kubernetes clusters employing VM images created with the Kubernetes Image Builder using the Proxmox provider are at risk. This specificity means that not all Kubernetes deployments are vulnerable, but those that are need to take immediate action to mitigate the threat.

Immediate Mitigations

As a temporary workaround, affected users are advised to disable the builder account on any vulnerable VMs. Additionally, it is recommended that users rebuild affected images using the updated version of the Image Builder (version 0.1.38) and redeploy them on their VMs. The latest version addresses the vulnerability by eliminating default credentials in favor of a randomly generated password that is set only for the duration of the image build process. Furthermore, the builder account is disabled at the end of the build, significantly reducing the risk of unauthorized access.

Related Vulnerabilities

In version 0.1.38, the Kubernetes team also addressed another related issue, CVE-2024-9594, which has a lower severity rating (CVSS score: 6.3). This vulnerability concerns default credentials when image builds are created using other providers such as Nutanix, OVA, QEMU, or raw. The lower severity score is due to the fact that these VMs are only affected if an attacker has access to the VM at the time of the image build, making it less likely for exploitation compared to the more critical vulnerability.

Broader Context of Cybersecurity Threats

This Kubernetes vulnerability is part of a broader trend of security issues affecting software and cloud services. For instance, Microsoft recently released server-side patches for three critical vulnerabilities that could lead to privilege escalation and information disclosure across its platforms. These include:

• CVE-2024-38139 (CVSS score: 8.7) – Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.
• CVE-2024-38204 (CVSS score: 7.5) – Improper access control in Imagine Cup enables an authorized attacker to elevate privileges.
• CVE-2024-38190 (CVSS score: 8.6) – Missing authorization in Power Platform allows unauthenticated attackers to view sensitive information.

In addition to these vulnerabilities, a critical issue was disclosed in the Apache Solr open-source enterprise search engine, identified as CVE-2024-45216 (CVSS score: 9.8). This vulnerability could allow attackers to bypass authentication altogether, posing a significant risk to exposed Solr instances.