CVE-2023-3676: Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

High severity · published Oct 31, 2023

CVE-2023-3676

Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation

8.8

CVSS

13.2%

EPSS

On KEV

Description

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)13.2% · higher than 96% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

kubelet · Kubernetes

v1.28.0; v1.27.0 through v1.27.4; v1.26.0 through v1.26.7; v1.25.0 through v1.25.12; through v1.24.16 · source: vendor

Kubernetes · Kubernetes

before 1.24.17; 1.25.0 before 1.25.13; 1.26.0 before 1.26.8; 1.27.0 before 1.27.5; 1.28.0 before 1.28.1 · source: NVD

Affected product

kubelet

Kubernetes

All kubelet CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-3676

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-3676

Exploit

https://github.com/kubernetes/kubernetes/issues/119339

Third Party Advisory

https://groups.google.com/g/kubernetes-security-announce/c/d_fvHZ9a5zc

security.netapp.com

https://security.netapp.com/advisory/ntap-20231130-0007/