Vulnerability · Published Jul 23, 2020 · Assigned by kubernetes
CVE-2020-8557Kubernetes node disk Denial of Service by writing to container /etc/hosts
Medium 5.5
In plain English
A medium-severity uncontrolled resource consumption in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | k3s | 1.18.6.1-r0 | ALPINE-CVE-2020-8557 |
| Alpine:v3.21 | k3s | 1.18.6.1-r0 | ALPINE-CVE-2020-8557 |
| Alpine:v3.22 | k3s | 1.18.6.1-r0 | ALPINE-CVE-2020-8557 |
| Alpine:v3.23 | k3s | 1.18.6.1-r0 | ALPINE-CVE-2020-8557 |
| Alpine:v3.24 | k3s | 1.18.6.1-r0 | ALPINE-CVE-2020-8557 |
| Debian:12 | kubernetes | 1.18.5-1 | DEBIAN-CVE-2020-8557 |
| Debian:13 | kubernetes | 1.18.5-1 | DEBIAN-CVE-2020-8557 |
| Debian:14 | kubernetes | 1.18.5-1 | DEBIAN-CVE-2020-8557 |
| Go | k8s.io/kubernetes | 1.16.13, 1.17.9, 1.18.6 | GO-2024-2753 |
| Go | k8s.io/kubernetes/pkg/kubelet | 1.18.6 | GHSA-55qj-gj3x-jq9r |
| Go | k8s.io/kubernetes/pkg/kubelet | 1.16.13 | GHSA-55qj-gj3x-jq9r |
| Go | k8s.io/kubernetes/pkg/kubelet | 1.17.9 | GHSA-55qj-gj3x-jq9r |
| Ubuntu:22.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2020-8557 |
| Ubuntu:24.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2020-8557 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | 1.151.141.131.121.111.101.91.8 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/kubernetes/kubernetes/issues/93032 x_refsource_CONFIRM
- [Security Advisory] CVE-2020-8557: Node disk DOS by writing to container /etc/hosts mailing-list, x_refsource_MLIST
- https://security.netapp.com/advisory/ntap-20200821-0002/ x_refsource_CONFIRM