6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-5321

CVE-2024-5321: Kubernetes sets incorrect permissions on Windows containers logs

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-5321

CVE-2024-5321:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
k8s.io/kubernetes	go	< 1.27.16	1.27.16
k8s.io/kubernetes	go	>= 1.28.0, < 1.28.12	1.28.12
k8s.io/kubernetes	go	>= 1.29.0, < 1.29.7	1.29.7
k8s.io/kubernetes	go	>= 1.30.0, < 1.30.3	1.30.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from Kubernetes creating container log directories on Windows nodes with default permissions that were too permissive, allowing BUILTIN\Users to read and NT AUTHORITY\Authenticated Users to modify logs. The patches address this by introducing Windows-specific permission-setting logic using SetNamedSecurityInfo and related Windows APIs. This new logic is encapsulated in pkg/util/filesystem.Chmod and pkg/util/filesystem.MkdirAll for Windows.

The identified vulnerable functions are those that, prior to the patch, were responsible for creating these log directories (or other relevant directories) using os.MkdirAll or similar calls without subsequently applying the correct restrictive ACLs on Windows.

(*Kubelet).setupDataDirs directly called os.MkdirAll for log directories and others; these calls were replaced by utilfs.MkdirAll.
(*Kubelet).initializeModules (or setupDataDirs in some versions) lacked an explicit step to set permissions on ContainerLogsDir for Windows; this was added.
NewKubeGenericRuntimeManager created podLogsRootDirectory and lacked a step to set correct Windows permissions; this was added.
(*DefaultFs).MkdirAll was a wrapper that previously called os.MkdirAll directly; it was changed to use the new Windows-aware MkdirAll from the same package. These functions, in their pre-patch state, would lead to the creation of directories with insecure default permissions on Windows.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.