CVE-2023-1943 is a high-severity privilege escalation vulnerability affecting certain versions of Kubernetes Operations (kOps) when used with the GCE/GCP provider in Gossip Mode. This security issue allows a container running in the cluster to use Node service account credentials to access sensitive information from the state storage bucket and escalate to cluster-admin permissions. Systems running specific versions of kOps are at risk, and users are advised to update to fixed versions or follow recommendations for their respective cloud providers.

How do I know if I'm affected?

If you're using Kubernetes Operations (kOps) with the GCE/GCP provider in Gossip Mode, you might be affected by the vulnerability. The affected versions are up to (excluding) 1.25.4 and from (including) 1.26.0 up to (excluding) 1.26.2. To know if you're affected, check your kOps version.

What should I do if I'm affected?

If you're affected by the vulnerability, follow these steps. Upgrade to the recommended kOps version for your cloud provider, such as 1.26.2 or later for GCE users. If you find evidence of exploitation, contact security@kubernetes.io. Remember to always keep your software updated to prevent security issues.

Is CVE-2023-1943 in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-1943 vulnerability, known as Privilege Escalation in kOps using GCE/GCP Provider in Gossip Mode, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was added to the National Vulnerability Database on October 11, 2023. There is no specific due date or required action mentioned, but users are advised to update their kOps software to fixed versions and contact security@kubernetes.io if they find evidence of exploitation.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-250, which involves execution with unnecessary privileges in kOps using GCE/GCP Provider in Gossip Mode, affecting specific versions and configurations. Fixed versions are available to address the issue.

For more details

CVE-2023-1943, a high-severity privilege escalation vulnerability in kOps using GCE/GCP Provider in Gossip Mode, affects specific versions and configurations. Users are advised to update their software and monitor for signs of exploitation. For a comprehensive analysis of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or the links below.

• kOps GitHub Issue #15539

• Kubernetes Security Advisory