CVE-2021-24109: Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Overview

Severity

Medium (CVSS 6.8)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2021-Feb

Released

2021-02-09

EPSS Score

4.96% (percentile: 89.7%)

FAQ

How do I know if I need to install the update? Customer should verify if they are running virtual nodes or virtual-kubelet by running the following command: kubectl get nodes -o wide, the kubelet version will report like vk-<version> Which virtual node version versions are affected? The affected versions are v1.18.4-vk-azure-aci-v1.3.2 (virtual node version below this should do an upgrade.) Where can I install the update? Customers using Azure Kubernetes Service are automatically upgraded with the new patched version. If you are installing using the helm chart or image, you can update the image reference to mcr.microsoft.com/oss/virtual-kubelet/virtual-kubelet:1.3.2

Affected Products (1)

Azure

• Microsoft Azure Kubernetes Service

Revision History

• 2021-02-09: Information published.