4

CVSS Score

3.1

Basic Information

CVE ID

CVE-2022-31077

GHSA ID

GHSA-x938-fvfw-7jh5

EPSS Score

0.54638%

CWE

CWE-476

Published

6/25/2022

Updated

1/27/2023

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2022-31077

CVE-2022-31077: CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server

Impact

A malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. An attacker would already need to be an authenticated user of the Cloud, and only when the authenticated user launches the csidriver then CloudCore may be attacked.

Patches

This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue.

Workarounds

At the time of writing, no workaround exists.

References

Credits

Thanks David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the kubeedge security policy during a security audit sponsored by CNCF and facilitated by OSTIF.

For more information

If you have any questions or comments about this advisory:

Open an issue in KubeEdge repo
To make a vulnerability report, email your vulnerability to the private cncf-kubeedge-security@lists.cncf.io list with the security details and the details expected for KubeEdge bug reports.

Notes: This vulnerability was found by fuzzing KubeEdge by way of OSS-Fuzz.

(GitHub Advisory)

4

CVSS Score

3.1

Basic Information

CVE ID

CVE-2022-31077

GHSA ID

GHSA-x938-fvfw-7jh5

EPSS Score

0.54638%

CWE

CWE-476

Published

6/25/2022

Updated

1/27/2023

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kubeedge/kubeedge	go	= 1.10.0	1.10.1
github.com/kubeedge/kubeedge	go	< 1.9.3	1.9.3

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from nil-pointer dereferences during message processing. The commit diff shows multiple functions were modified to return &struct{} instead of nil pointers in error cases. Specifically:

ExtractMessage in udsserver/server.go previously returned nil on empty context/unmarshal errors
extractMessage in csidriver/utils.go used pointer declarations vulnerable to nil returns
Similar patterns in node/pvc/volumeattachment handlers (node.go shown as example) These functions would crash when callers attempted to use the returned nil pointers. The fixes ensure non-nil returns even in error cases, confirming these were the vulnerable points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * m*li*ious m*ss*** r*spons* *rom Ku****** **n *r*s* t** *SI *riv*r *ontroll*r s*rv*r *y tri***rin* * nil-point*r **r***r*n** p*ni*. *s * *ons*qu*n**, t** *SI *riv*r *ontroll*r will ** in **ni*l o* s*rvi**. *n *tt**k*r woul* *lr***y n*** t

Reasoning

T** vuln*r**ility st*ms *rom nil-point*r **r***r*n**s *urin* m*ss*** pro**ssin*. T** *ommit *i** s*ows multipl* *un*tions w*r* mo*i*i** to r*turn &stru*t{} inst*** o* nil point*rs in *rror **s*s. Sp**i*i**lly: *. *xtr**tM*ss*** in u*ss*rv*r/s*rv*r.*

4

Basic Information

Concerned about an active attack path?

CVE-2022-31077: CloudCore CSI Driver: Malicious response from KubeEdge can crash CSI Driver controller server

Impact

Patches

Workarounds

References

Credits

For more information

4

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI