Container Service for Kubernetes:Advis keamanan: CVE-2026-31431

Prasyarat

Sebelum memulai, pastikan hal berikut:

• Beban kerja Anda tidak bergantung pada modul kernel AF_ALG (digunakan untuk akselerasi kriptografi di ruang kernel, seperti IPsec atau libkcapi).

• Tidak ada profil seccomp tipe Localhost lain yang dikonfigurasi di bidang securityContext.seccompProfile Pod beban kerja Anda.

1. Deploy DaemonSet seccomp

DaemonSet ini menulis file kebijakan seccomp ke setiap node Linux di kluster Anda. Setelah file dibuat, terapkan kebijakan tersebut dengan mereferensikannya di Pod beban kerja Anda seperti dijelaskan dalam Langkah 2.

1. Simpan manifes YAML berikut sebagai seccomp-block-AF_ALG.yaml.

   DaemonSet menulis seccomp-block-af_alg.json ke /var/lib/kubelet/seccomp/profiles/ di semua node Linux.

   YAML

   apiVersion: apps/v1
   kind: DaemonSet
   metadata:
     name: ack-cve-2026-31431-mitigate
     namespace: kube-system
     labels:
       app: ack-cve-2026-31431-mitigate
   spec:
     selector:
       matchLabels:
         app: ack-cve-2026-31431-mitigate
     template:
       metadata:
         labels:
           app: ack-cve-2026-31431-mitigate
       spec:
         priorityClassName: system-node-critical
         nodeSelector:
           kubernetes.io/os: linux
         tolerations:
           - operator: Exists
         containers:
           - name: mitigate
             image: registry-cn-hangzhou.ack.aliyuncs.com/acs/busybox:1.35
             command:
               - /bin/sh
               - -c
               - |
                 echo "=== Mitigasi CVE-2026-31431 ==="
   
                 cat <<EOF > /kubelet-seccomp/seccomp-block-af_alg.json
                 {
                   "defaultAction": "SCMP_ACT_ERRNO",
                   "architectures": [
                     "SCMP_ARCH_X86_64",
                     "SCMP_ARCH_X86",
                     "SCMP_ARCH_X32",
                     "SCMP_ARCH_AARCH64",
                     "SCMP_ARCH_ARM"
                   ],
                   "syscalls": [
                     {
                       "names": ["socket"],
                       "action": "SCMP_ACT_ERRNO",
                       "args": [
                         {
                           "index": 0,
                           "value": 38,
                           "op": "SCMP_CMP_EQ"
                         }
                       ]
                     },
                     {
                       "names": ["socket"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [
                         {
                           "index": 0,
                           "value": 40,
                           "op": "SCMP_CMP_NE"
                         }
                       ]
                     },
                     {
                       "names": [
                         "accept", "accept4", "access", "adjtimex", "alarm", "bind", "brk",
                         "cachestat", "capget", "capset", "chdir", "chmod", "chown", "chown32",
                         "clock_adjtime", "clock_adjtime64", "clock_getres", "clock_getres_time64",
                         "clock_gettime", "clock_gettime64", "clock_nanosleep", "clock_nanosleep_time64",
                         "close", "close_range", "connect", "copy_file_range", "creat",
                         "dup", "dup2", "dup3",
                         "epoll_create", "epoll_create1", "epoll_ctl", "epoll_ctl_old",
                         "epoll_pwait", "epoll_pwait2", "epoll_wait", "epoll_wait_old",
                         "eventfd", "eventfd2", "execve", "execveat", "exit", "exit_group",
                         "faccessat", "faccessat2", "fadvise64", "fadvise64_64", "fallocate",
                         "fanotify_mark", "fchdir", "fchmod", "fchmodat", "fchmodat2",
                         "fchown", "fchown32", "fchownat", "fcntl", "fcntl64", "fdatasync",
                         "fgetxattr", "flistxattr", "flock", "fork", "fremovexattr", "fsetxattr",
                         "fstat", "fstat64", "fstatat64", "fstatfs", "fstatfs64", "fsync",
                         "ftruncate", "ftruncate64",
                         "futex", "futex_requeue", "futex_time64", "futex_wait", "futex_waitv", "futex_wake",
                         "futimesat", "getcpu", "getcwd", "getdents", "getdents64",
                         "getegid", "getegid32", "geteuid", "geteuid32",
                         "getgid", "getgid32", "getgroups", "getgroups32", "getitimer",
                         "getpeername", "getpgid", "getpgrp", "getpid", "getppid", "getpriority",
                         "getrandom", "getresgid", "getresgid32", "getresuid", "getresuid32",
                         "getrlimit", "get_robust_list", "getrusage", "getsid", "getsockname",
                         "getsockopt", "get_thread_area", "gettid", "gettimeofday",
                         "getuid", "getuid32", "getxattr", "getxattrat",
                         "inotify_add_watch", "inotify_init", "inotify_init1", "inotify_rm_watch",
                         "io_cancel", "ioctl", "io_destroy", "io_getevents",
                         "io_pgetevents", "io_pgetevents_time64", "ioprio_get", "ioprio_set",
                         "io_setup", "io_submit", "ipc", "kill",
                         "landlock_add_rule", "landlock_create_ruleset", "landlock_restrict_self",
                         "lchown", "lchown32", "lgetxattr", "link", "linkat", "listen",
                         "listmount", "listxattr", "listxattrat", "llistxattr", "_llseek",
                         "lremovexattr", "lseek", "lsetxattr",
                         "lsm_get_self_attr", "lsm_list_modules", "lsm_set_self_attr",
                         "lstat", "lstat64", "madvise", "membarrier", "memfd_create", "memfd_secret",
                         "mincore", "mkdir", "mkdirat", "mknod", "mknodat",
                         "mlock", "mlock2", "mlockall", "map_shadow_stack",
                         "mmap", "mmap2", "mprotect",
                         "mq_getsetattr", "mq_notify", "mq_open",
                         "mq_timedreceive", "mq_timedreceive_time64",
                         "mq_timedsend", "mq_timedsend_time64", "mq_unlink",
                         "mremap", "mseal", "msgctl", "msgget", "msgrcv", "msgsnd", "msync",
                         "munlock", "munlockall", "munmap",
                         "name_to_handle_at", "nanosleep", "newfstatat", "_newselect",
                         "open", "openat", "openat2", "pause",
                         "pidfd_open", "pidfd_send_signal", "pipe", "pipe2",
                         "pkey_alloc", "pkey_free", "pkey_mprotect",
                         "poll", "ppoll", "ppoll_time64", "prctl",
                         "pread64", "preadv", "preadv2", "prlimit64",
                         "process_mrelease", "pselect6", "pselect6_time64",
                         "pwrite64", "pwritev", "pwritev2",
                         "read", "readahead", "readlink", "readlinkat", "readv",
                         "recv", "recvfrom", "recvmmsg", "recvmmsg_time64", "recvmsg",
                         "remap_file_pages", "removexattr", "removexattrat",
                         "rename", "renameat", "renameat2", "restart_syscall", "rmdir", "rseq",
                         "rt_sigaction", "rt_sigpending", "rt_sigprocmask", "rt_sigqueueinfo",
                         "rt_sigreturn", "rt_sigsuspend", "rt_sigtimedwait", "rt_sigtimedwait_time64",
                         "rt_tgsigqueueinfo",
                         "sched_getaffinity", "sched_getattr", "sched_getparam",
                         "sched_get_priority_max", "sched_get_priority_min", "sched_getscheduler",
                         "sched_rr_get_interval", "sched_rr_get_interval_time64",
                         "sched_setaffinity", "sched_setattr", "sched_setparam",
                         "sched_setscheduler", "sched_yield", "seccomp", "select",
                         "semctl", "semget", "semop", "semtimedop", "semtimedop_time64",
                         "send", "sendfile", "sendfile64", "sendmmsg", "sendmsg", "sendto",
                         "setfsgid", "setfsgid32", "setfsuid", "setfsuid32",
                         "setgid", "setgid32", "setgroups", "setgroups32", "setitimer", "setpgid",
                         "setpriority", "setregid", "setregid32", "setresgid", "setresgid32",
                         "setresuid", "setresuid32", "setreuid", "setreuid32", "setrlimit",
                         "set_robust_list", "setsid", "setsockopt", "set_thread_area",
                         "set_tid_address", "setuid", "setuid32", "setxattr", "setxattrat",
                         "shmat", "shmctl", "shmdt", "shmget", "shutdown",
                         "sigaltstack", "signalfd", "signalfd4", "sigprocmask", "sigreturn",
                         "socketcall", "socketpair", "splice",
                         "stat", "stat64", "statfs", "statfs64", "statmount", "statx",
                         "symlink", "symlinkat", "sync", "sync_file_range", "syncfs", "sysinfo",
                         "tee", "tgkill", "time",
                         "timer_create", "timer_delete", "timer_getoverrun",
                         "timer_gettime", "timer_gettime64", "timer_settime", "timer_settime64",
                         "timerfd_create", "timerfd_gettime", "timerfd_gettime64",
                         "timerfd_settime", "timerfd_settime64",
                         "times", "tkill", "truncate", "truncate64", "ugetrlimit", "umask",
                         "uname", "unlink", "unlinkat", "uretprobe",
                         "utime", "utimensat", "utimensat_time64", "utimes",
                         "vfork", "vmsplice", "wait4", "waitid", "waitpid", "write", "writev",
                         "bpf", "chroot", "clone3", "fanotify_init", "fsconfig", "fsmount",
                         "fsopen", "fspick", "get_mempolicy", "io_uring_enter", "io_uring_register",
                         "io_uring_setup", "iopl", "ioperm", "kcmp", "keyctl", "add_key",
                         "request_key", "lookup_dcookie", "mbind", "migrate_pages", "mount",
                         "mount_setattr", "move_mount", "umount2", "move_pages", "nfsservctl",
                         "open_tree", "perf_event_open", "pidfd_getfd", "pivot_root",
                         "process_vm_readv", "process_vm_writev", "ptrace", "quotactl",
                         "quotactl_fd", "reboot", "set_mempolicy", "set_mempolicy_home_node",
                         "setdomainname", "sethostname", "setns", "swapon", "swapoff",
                         "syslog", "unshare", "userfaultfd", "vhangup"
                       ],
                       "action": "SCMP_ACT_ALLOW"
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 0, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 8, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 131072, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 131080, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["personality"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 4294967295, "op": "SCMP_CMP_EQ" }]
                     },
                     {
                       "names": ["clone"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 2114060288, "op": "SCMP_CMP_MASKED_EQ", "valueTwo": 0 }]
                     },
                     {
                       "names": ["arch_prctl"],
                       "action": "SCMP_ACT_ALLOW",
                       "args": [{ "index": 0, "value": 4114, "op": "SCMP_CMP_NE" }]
                     }
                   ]
                 }
   
                 EOF
   
                 echo "=== Mitigasi selesai. Pastikan securityContext Pod Anda dikonfigurasi untuk menggunakan profil seccomp ini (type: Localhost, localhostProfile: profiles/seccomp-block-af_alg.json). Tidur agar DaemonSet tetap berjalan. ==="
                 sleep infinity
             resources:
               requests:
                 cpu: 10m
                 memory: 16Mi
               limits:
                 memory: 32Mi
             volumeMounts:
               - name: kubelet-seccomp-root
                 mountPath: /kubelet-seccomp
         volumes:
           - name: kubelet-seccomp-root
             hostPath:
               path: /var/lib/kubelet/seccomp/profiles
               type: DirectoryOrCreate

2. Terapkan manifes untuk deploy DaemonSet.

   kubectl apply -f seccomp-block-AF_ALG.yaml

3. Setelah deployment, verifikasi bahwa file kebijakan telah ditulis ke setiap node.

   # Verifikasi bahwa DaemonSet siap di semua node.
   kubectl -n kube-system get daemonset ack-cve-2026-31431-mitigate
   # Periksa log untuk memastikan kebijakan telah ditulis. Output harus mencakup "Mitigasi selesai".
   kubectl -n kube-system logs -l app=ack-cve-2026-31431-mitigate --tail=3

2. Konfigurasikan profil seccomp untuk Pod aplikasi

File kebijakan tidak diterapkan ke Pod secara otomatis. Referensikan secara eksplisit di securityContext setiap Pod beban kerja.

1. Konfigurasikan profil seccomp.

   Di securityContext Pod beban kerja Anda, atur tipe seccompProfile ke Localhost dan gunakan localhostProfile untuk menentukan path relatif terhadap direktori root seccomp node (/var/lib/kubelet/seccomp).

   securityContext:
     seccompProfile:
       type: Localhost
       localhostProfile: profiles/seccomp-block-af_alg.json

2. Setelah menerapkan perubahan, restart Pod beban kerja Anda.

3. Pantau Pod beban kerja untuk memastikan berjalan dengan benar:

   • Jika Pod berhasil dimulai, profil seccomp aktif dan mitigasi berlaku.

   • Jika Pod gagal dimulai atau crash, segera kembalikan perubahan tersebut.