Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-7598

CVE-2024-7598: Kubernetes kube-apiserver Vulnerable to Race Condition

3.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-7598
GHSA ID
GHSA-r56h-j38w-hrqq
EPSS Score
0.00541%
CWE
CWE-362
Published
3/20/2025
Updated
3/21/2025
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
k8s.io/kubernetes/cmd/kube-apiservergo

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from undefined deletion order during namespace termination. The namespace controller's deleteAllContent() function is responsible for cascading deletion of namespace resources. Since it processes resource types in an arbitrary order (typically alphabetical by API group/version), NetworkPolicy resources (networking.k8s.io/v1) may be deleted before Pod resources (v1), creating the race condition. The function's lack of synchronization or ordering logic for dependent resource types directly enables the vulnerability scenario described.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* s**urity issu* w*s *is*ov*r** in Ku**rn*t*s w**r* * m*li*ious or *ompromis** po* *oul* *yp*ss n*twork r*stri*tions *n*or*** *y n*twork poli*i*s *urin* n*m*sp*** **l*tion. T** or**r in w*i** o*j**ts *r* **l*t** *urin* n*m*sp*** t*rmin*tion is not **

Reasoning

T** vuln*r**ility st*ms *rom un***in** **l*tion or**r *urin* n*m*sp*** t*rmin*tion. T** n*m*sp*** *ontroll*r's `**l*t**ll*ont*nt()` *un*tion is r*sponsi*l* *or **s***in* **l*tion o* n*m*sp*** r*sour**s. Sin** it pro**ss*s r*sour** typ*s in *n *r*itr*