The Kubernetes community disclosed security vulnerability CVE-2024-3177. An attacker can bypass restrictions enforced by the ServiceAccount admission plugin on Secret mounts using the envFrom field in a workload’s container definition. This could result in sensitive information leakage. The vulnerability is rated low severity with a CVSS score of 2.7. For more information about this vulnerability, see #124336.
Impact scope
The following versions of the kube-apiserver component are affected:
v1.29.0 through v1.29.3
v1.28.0 through v1.28.8
v1.27.12 and earlier
The community fixed this issue in the following versions:
v1.29.4
v1.28.9
v1.27.13
ACK clusters with default installed components are not affected. However, your cluster may be vulnerable if its workloads meet both of the following conditions:
A container, init container, or ephemeral container in the workload uses the
envFromfield to mount a Secret instance.The workload uses a ServiceAccount annotated with
kubernetes.io/enforce-mountable-secrets. Run the following command to identify potentially vulnerable ServiceAccount instances in your cluster:kubectl get serviceaccounts --all-namespaces -o jsonpath="{range .items[?(@.metadata.annotations['kubernetes\.io/enforce-mountable-secrets']=='true')]}{.metadata.namespace}{'\t'}{.metadata.name}{'\n'}{end}"
Recommended solution
You can enable the API server audit log for your cluster to detect unexpected updates to the envFrom field in pods. For details, see Use the cluster API Server audit feature.