CVE-2021-24109: Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CVE-2021-24109 is an elevation of privilege vulnerability in Microsoft Azure Kubernetes Service, rated Moderate by Microsoft, with a CVSS 3.1 base score of 6.8 (Medium). An attacker can exploit it remotely over the network, with high privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 2.17% probability of exploitation activity in the next 30 days, higher than 82% of all scored vulnerabilities. Microsoft published it on 9 February 2021 in the February 2021 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2021-24109
- Severity
- Medium CVSS 6.8
- Microsoft severity
- Moderate
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- EPSS
- 2.17% (percentile 82%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- February 2021 Patch Tuesday
- Product families
- Azure
CVSS score and vector
Microsoft scores CVE-2021-24109 at 6.8 (temporal 5.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
How do I know if I need to install the update?
Customer should verify if they are running virtual nodes or virtual-kubelet by running the following command:
kubectl get nodes -o wide, the kubelet version will report like vk-<version>
Which virtual node version versions are affected?
The affected versions are v1.18.4-vk-azure-aci-v1.3.2 (virtual node version below this should do an upgrade.)
Where can I install the update?
Customers using Azure Kubernetes Service are automatically upgraded with the new patched version.
If you are installing using the helm chart or image, you can update the image reference to mcr.microsoft.com/oss/virtual-kubelet/virtual-kubelet:1.3.2
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Azure Kubernetes Service |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 6.8 (MEDIUM)
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure kubernetes service | all listed versions |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24109 (Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24109 (Patch, Vendor Advisory)
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |