CVE-2020-8558: Kubernetes node setting allows for neighboring hosts to bypass localhost boundary
A flaw was found in Kubernetes that allows attackers on adjacent networks to reach services exposed on localhost ports, previously thought to be unreachable. This flaw allows an attacker to gain privileges or access confidential information for any services listening on localhost ports that are not protected by authentication.
Other sources
Kubernetes' kube-proxy enables net.ipv4.conf.all.routelocalnet by default on all nodes. This allows neighbouring hosts on the local network to reach ports on Kubernetes nodes that are only exposed on localhost.
— Red Hat
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID for this Kubernetes flaw?
The vulnerability ID for this flaw in Kubernetes is CVE-2020-8558.
What is the severity of CVE-2020-8558?
CVE-2020-8558 has a severity of 5.4, which is considered medium.
How does CVE-2020-8558 impact Kubernetes?
CVE-2020-8558 allows attackers on adjacent networks to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace.
Which versions of Kubernetes are affected by CVE-2020-8558?
Versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 of Kubernetes are affected by CVE-2020-8558.
How can I fix CVE-2020-8558 in Kubernetes?
To fix CVE-2020-8558 in Kubernetes, update to version 1.19.0, 1.18.4, or 1.17.7, depending on your current version.