GHSA-qjvc-p88j-j9rm: Kyverno's PolicyException objects can be created in any namespace by default

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2024-48921

Kyverno’s PolicyException objects can be created in any namespace by default

High severity GitHub Reviewed Published Oct 29, 2024 in kyverno/kyverno • Updated Oct 29, 2024

Package

gomod github.com/kyverno/kyverno (Go)

Affected versions

< 1.13.0

Summary

A kyverno ClusterPolicy, ie. “disallow-privileged-containers,” can be overridden by the creation of a PolicyException in a random namespace.

Details

By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions.

PoC

1. Administrator creates “disallow-privileged-containers” ClusterPolicy that applies to resources in the namespace “ubuntu-restricted”
2. Cluster user creates a PolicyException object for “disallow-privileged-containers” in namespace “ubuntu-restricted”
3. Cluster user creates a pod with a privileged container in “ubuntu-restricted”
4. Cluster user escalates to root on the node from the privileged container

Impact

Administrators attempting to enforce cluster security through kyverno policies, but that allow less privileged users to create resources

References

• GHSA-qjvc-p88j-j9rm

Published to the GitHub Advisory Database

Oct 29, 2024

Last updated

Oct 29, 2024