What is CVE-2023-3676?

CVE-2023-3676 is a high-severity vulnerability affecting Kubernetes clusters with Windows nodes. This issue allows users who can create pods on Windows nodes to potentially escalate their privileges to admin level. It impacts various systems running Kubernetes with Windows nodes, including multiple NetApp products. Organizations using Kubernetes should be aware of this vulnerability and take steps to mitigate the risk.

Who is impacted by CVE-2023-3676?

CVE-2023-3676 affects users who can create pods on Windows nodes in Kubernetes clusters. It impacts Kubernetes versions up to 1.24.16, 1.25.12, 1.26.7, 1.27.4, and 1.28.0. This issue could allow these users to escalate their privileges to admin level on the affected Windows nodes.

What to do if CVE-2023-3676 affected you

If you're affected by the CVE-2023-3676 vulnerability, it's crucial to take action to secure your Kubernetes clusters with Windows nodes. Follow these steps:

1. Upgrade to the fixed versions of kubelet (v1.28.1, v1.27.5, v1.26.8, v1.25.13, or v1.24.17).

2. Monitor Kubernetes audit logs for signs of exploitation, such as pod create events with embedded PowerShell commands.

3. Contact security@kubernetes.io if you find evidence of exploitation.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-3676 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity issue affects Kubernetes clusters with Windows nodes, allowing users who can create pods on these nodes to potentially escalate their privileges to admin level. To address this vulnerability, it's crucial to upgrade to fixed versions of kubelet and monitor Kubernetes audit logs for signs of exploitation.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-20, which involves improper input validation in Kubernetes clusters with Windows nodes.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources below.

• GitHub Issue #119339

• NetApp Product Security Advisory