Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-8557

CVE-2020-8557: Denial of service in Kubernetes

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-8557
GHSA ID
GHSA-55qj-gj3x-jq9r
EPSS Score
0.3808%
CWE
CWE-400
Published
4/24/2024
Updated
6/10/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
k8s.io/kubernetes/pkg/kubeletgo>= 1.1.0, < 1.16.131.16.13
k8s.io/kubernetes/pkg/kubeletgo>= 1.17.0, < 1.17.91.17.9
k8s.io/kubernetes/pkg/kubeletgo>= 1.18.0, < 1.18.61.18.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability root cause was the kubelet's failure to include pod /etc/hosts file in ephemeral storage calculations. The patch adds explicit handling for this file in podLocalEphemeralStorageUsage. The pre-patch version of this function lacked the critical 'os.Stat(etcHostsPath)' check and subsequent disk usage accounting shown in the diff, making it the clear vulnerable function. The eviction manager's modifications to pass etcHostsPath parameter and call pattern changes confirm this was the missing piece in storage calculation logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T** Ku**rn*t*s ku**l*t *ompon*nt in v*rsions *.*-*.**.**, *.**.*-*.**.* *n* *.**.*-*.**.* *o not ***ount *or *isk us*** *y * po* w*i** writ*s to its own /*t*/*osts *il*. T** /*t*/*osts *il* mount** in * po* *y ku**l*t is not in*lu*** *y t** ku**l*t *

Reasoning

T** vuln*r**ility root **us* w*s t** ku**l*t's **ilur* to in*lu** po* `/*t*/*osts` *il* in *p**m*r*l stor*** **l*ul*tions. T** p*t** ***s *xpli*it **n*lin* *or t*is *il* in `po*Lo**l*p**m*r*lStor***Us***`. T** pr*-p*t** v*rsion o* t*is `*un*tion` l**