Vulnerability · Published Jun 27, 2022 · Assigned by GitHub_M
CVE-2022-31077Malicious response from KubeEdge can crash CSI Driver controller server
Medium 4.0
In plain English
A medium-severity null pointer dereference in kubeedge from kubeedge. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kubeedge/kubeedge | 1.10.1 | GHSA-x938-fvfw-7jh5 |
| Go | github.com/kubeedge/kubeedge | 1.9.3 | GHSA-x938-fvfw-7jh5 |
| Go | github.com/kubeedge/kubeedge | 1.10.1, 1.9.3 | GO-2022-0501 |
Affected products (as reported)
Weakness: CWE-476 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H