CVSS Rating: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

Am I vulnerable?

All clusters running an affected version listed below with the kubelet read-only HTTP port enabled and using a container runtime that supports the container checkpointing feature, such as CRI-O v1.25.0+ (with enable_criu_support set to true) or containerd v2.0+ with criu installed, are affected.

Affected Versions

• kubelet v1.32.0 to v1.32.1
• kubelet v1.31.0 to v1.31.5
• kubelet v1.30.0 to v1.30.9

How do I mitigate this vulnerability?

This issue can be mitigated by setting the ContainerCheckpoint feature gate to false in your kubelet configuration, disabling the kubelet read-only port, and limiting access to the kubelet API, or upgrading to a fixed version listed below, which enforces authentication for the kubelet Checkpoint API.

Fixed Versions

• kubelet master - fixed by Kubelet server handler cleanup #129739
• kubelet v1.32.2 - fixed by Automated cherry pick of #129739: Kubelet server handler cleanup #130010
• kubelet v1.31.6 - fixed by Automated cherry pick of #129739: Kubelet server handler cleanup #130011
• kubelet v1.30.10 - fixed by Automated cherry pick of #129739: Kubelet server handler cleanup #130012
• kubelet v1.29.14 - fixed by Automated cherry pick of #129739: Kubelet server handler cleanup #130014
  • Note: Container checkpoint support was an off by default Alpha feature in v1.25-v1.29

Detection

A large number of requests to the kubelet read-only HTTP server's /checkpoint endpoint, or a large number of checkpoints stored (by default) under /var/lib/kubelet/checkpoints on a Node may indicate an attempted Denial of Service attack using this bug.

If you find evidence that this vulnerability has been exploited, please contact [email protected]

Acknowledgements

This vulnerability was reported and fixed by Tim Allclair @tallclair from Google.

The issue was coordinated by:

Tim Allclair @tallclair
Sascha Grunert saschagrunert@
Craig Ingram @cji
Jordan Liggitt liggitt@

/triage accepted
/lifecycle frozen
/area security
/kind bug
/committee security-response
/label official-cve-feed
/sig node
/area kubelet