Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Kubelet: Privilege Escalation — GLSA 202405-31

A vulnerability has been discovered in Kubelet, which can lead to privilege escalation.

Affected packages

Package sys-cluster/kubelet on all architectures
Affected versions < 1.28.5
Unaffected versions >= 1.28.5

Background

Kubelet is a Kubernetes Node Agent.

Description

A vulnerability has been discovered in Kubelet. Please review the CVE identifier referenced below for details.

Impact

A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.

Workaround

There is no known workaround at this time.

Resolution

All Kubelet users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=sys-cluster/kubelet-1.28.5"

References

Release date
May 12, 2024

Latest revision
May 12, 2024: 1

Severity
high

Exploitable
remote

Bugzilla entries