Ariel Zelivansky

A security issue in the Kubelet and kube-proxy components allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. This means that services thought to be reachable only by other processes on the same host could be accessed by other hosts on the same LAN or by containers on the same node. For instance, a TCP service running on a node and listening on 127.0.0.1:1234 could be potentially reachable by other hosts or containers, posing a risk if the service does not require additional authentication. IPv6-only services on localhost are not affected by this issue.

The issue is caused by an integer overflow that allows a remote attacker to crash the server by sending a crafted request. If authentication is enabled, the attacker must first authenticate. This can be exploited by sending a specifically crafted request to the server.

Name of the Vulnerable Software and Affected Versions: kubectl versions prior to 1.11.9 kubectl versions prior to 1.12.7 kubectl versions prior to 1.13.5 kubectl versions prior to 1.14.0 Description: The issue arises from the `kubectl cp` command, which allows copying files between containers and the user machine. When copying files from a container, Kubernetes creates a tar inside the container, copies it over the network, and `kubectl` unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when `kubectl cp` is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. Recommendations: For versions prior to 1.11.9, update to version 1.11.9 or later. For versions prior to 1.12.7, update to version 1.12.7 or later. For versions prior to 1.13.5, update to version 1.13.5 or later. For versions prior to 1.14.0, update to version 1.14.0 or later.

The issue is related to an Integer Underflow in the decompress unlzma.c file of BusyBox, which leads to a read access violation.

The issue allows context-dependent attackers to cause a denial of service, specifically an infinite loop, by utilizing a large TIFF file. This is related to the make available at least function in io-tiff.c.

The issue is related to an integer underflow in the load resources function in io-icns.c, which allows context-dependent attackers to cause a denial of service, resulting in an out-of-bounds read and program crash. This can be achieved via a crafted image entry size in an ICO file.

The issue is related to an integer overflow in the io-ico.c file of gdk-pixbuf, which allows attackers to cause a denial of service, resulting in a segmentation fault and application crash. This is achieved by providing a crafted image entry offset in an ICO file, triggering an out-of-bounds read. The issue is also related to compiler optimizations.

The issue allows context-dependent attackers to cause a denial of service, resulting in a NULL pointer dereference and application crash. This is achieved via vectors related to printing an error message.