CVE-2023-29332: Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 7.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2023-Sep
Released
2023-09-12
Last Updated
2023-09-14
EPSS Score
19.53% (percentile: 95.4%)

FAQ

What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain Cluster Administrator privileges. How do I protect my resources against this vulnerability? Customers must update or upgrade their Azure Kuberenetes Service resource deployments using the following guidance: Upgrade your AKS node image to receive the fix without altering your Kubernetes version. Upgrade your AKS cluster to a newer version which will also bring your node image to the latest version. What additional actions can customers take to help ensure their resources are secure? We highly encourage customers to enable automatic node image upgrades for their Azure Kubernetes Resources to get the latest security releases in the future. General Availability Customers: Automatically upgrade an Azure Kubernetes Service (AKS) cluster - Azure Kubernetes Service | Microsoft Learn CLI command: az aks update --resource-group [myResourceGroup] --name [myAKSCluster] --auto-upgrade-channel node-image Or Preview Customers: Automatically upgrade Azure Kubernetes Service (AKS) cluster node operating system images - Azure Kubernetes Service | Microsoft Learn: CLI command: az aks update --resource-group [myResourceGroup] --name [myAKSCluster] --node-os-upgrade-channel NodeImage According to the CVSS metric, attack complexity is high (AC:H) but integrity is none (I:N) and availability is none (A:N). What does that mean for this vulnerability? The Confidentiality is set to High because an attacker who successfully exploits this vulnerability could access tokens beyond a user’s typical privilege. The exploit results in token disclosure, however it does not affect the Integrity and Availability of the system. Thus, both of these are set as None. According to the CVSS metric, the attack vector is network (AV:N) and the attack complexity is low (AC:L). What does that mean for this vulnerability? The attack vector is set

Affected Products (1)

Azure

  • Azure Kubernetes Service

Security Updates (1)

Acknowledgments

Stav Nir

Revision History

  • 2023-09-12: Information published.
  • 2023-09-13: Added FAQ information. This is an informational change only.
  • 2023-09-13: Corrected one or more links in the FAQ. This is an informational change only.
  • 2023-09-14: Added FAQ information. This is an informational change only.