December 6, 2018
By Security Intelligence Staff 2 min read

This post originally appeared on the IBM Cloud blog and is being shared with permission.

What’s happening?

We’re taking action to secure our IBM Cloud Kubernetes Service against the recent Kubernetes security vulnerabilities.

IBM Cloud Kubernetes Service is affected by the following vulnerabilities that, in some cases, allow unauthorized access to Kubernetes and/or trusted user privilege escalation.

Vulnerability Details

Affected Products and Versions

  • Affected components: Kubernetes API server
  • Affected versions:
    • Kubernetes versions 1.0.x through 1.9.x
    • 1.12.0-1.12.2 (fixed in v1.12.3)
    • 1.11.0-1.11.4 (fixed in v1.11.5)
    • 1.10.0-1.10.10 (fixed in v1.10.11)
    • 1.9.x and 1.8.x (update to v1.10.11)
    • 1.7 (update to 1.9.x and then update to 1.10.11)
    • 1.5 (unsupported, no migration path)

What do I need to know?

This exposure affects your IBM Cloud Kubernetes cluster master only, there is no exposure to your IBM Cloud Kubernetes Workers.

There are two exploits as part of this vulnerability:

Vulnerability 1: Authenticated and unauthenticated requests can provide full admin access to Kubernetes API Server.

  • Affected users: This only affects users with aggregated API servers.
    • 1.11 and earlier: IBM Cloud Kubernetes Service does not deploy any aggregated API servers in versions 1.11 and earlier. You will not be impacted unless you have deployed your own aggregated API server.
    • 1.12: All users are affected since all clusters contain the metrics-server, which is an aggregated API server affected by this vulnerability.

Vulnerability 2: Authenticated users with specific permissions to exec/attach/portforward API calls can be escalated to perform any API request against the kubelet API on the node specified in the pod spec.

  • Affected users: All IBM Cloud Kubernetes Service clusters are affected by this vulnerability.

We are releasing updates for all supported releases of IBM Cloud Kubernetes Service this week. Then, all supported clusters will auto-update to remediate the vulnerabilities during the next few days.

How do I mitigate the issue?

If you are on a supported release, then you don’t need to do anything, your IBM Cloud Kubernetes Cluster Master will be updated automatically.

All supported IBM Cloud Kubernetes Service clusters at version 1.10 and later will be updated automatically to address this security flaw. If you find that your cluster has not been automatically updated over the next few days, please contact IBM Support.

Customers running unsupported IBM Cloud Kubernetes versions must upgrade the affected clusters to a supported version 1.10.11, 1.11.5, 1.12.3, or later when these versions are released by IBM.

Refer to https://cloud.ibm.com/docs/containers/cs_versions.html for more information about Kubernetes versions.

You do not need to update your workers for this exposure, we do recommend that you always stay current with your workers to ensure you are not vulnerable to other exposures.

How do I check my version?

To see which Kubernetes versions the IBM Cloud Kubernetes Service has released:
ibmcloud ks kube-versions

To see which version your clusters are currently using:
ibmcloud ks clusters

What about unsupported clusters?

For 1.9.x or 1.8.x, you must update your cluster to a supported release:
ibmcloud ks cluster-update --cluster <clustername> --kube-version 1.10

For 1.7.x, you must first update to 1.9 and then update to a supported release:

  1. Run: ibmcloud ks cluster-update --cluster <clustername> --kube-version 1.9
  2. Confirm that the update completed successfully by checking the Kubernetes version.
  3. Run: >ibmcloud ks cluster-update --cluster <clustername> --kube-version 1.10

Questions or comments

Please join us on our public Slack channel at https://ibm-container-service.slack.com or raise a support ticket if you have any issues.

 |  |  |  | 
Security Intelligence Staff
Security Intelligence Staff

Security Intelligence strives to be the leading site for technical and business-focused security content. Security is an essential factor for every business,...

More from

Risk Management   March 31, 2023

Is It Time to Start Hiding Your Work Emails?

In this digital age, it is increasingly important for businesses to be aware of their online presence and data security. Many companies have already implemented measures such as two-factor authentication and strong password policies – but there is still a great deal of exposure regarding email visibility. It should come as no surprise that cyber criminals are always looking for ways to gain access to sensitive information. Unfortunately, emails are a particularly easy target as many businesses do not encrypt…

Intelligence & Analytics   March 30, 2023

2022 Industry Threat Recap: Finance and Insurance

The finance and insurance sector proved a top target for cybersecurity threats in 2022. The IBM Security X-Force Threat Intelligence Index 2023 found this sector ranked as the second most attacked, with 18.9% of X-Force incident response cases. If, as Shakespeare tells us, past is prologue, this sector will likely remain a target in 2023. Finance and insurance ranked as the most attacked sector from 2016 to 2020, with the manufacturing sector the most attacked in 2021 and 2022. What…

Software Vulnerabilities   March 30, 2023

X-Force Prevents Zero Day from Going Anywhere

This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities are associated with a zero day. X-Force often observes zero-day exploitation on Internet-facing systems as a vector for initial access however, X-Force has also observed zero-day attacks leveraged by attackers to accomplish their goals and objectives after initial access was…

Intelligence & Analytics   March 30, 2023

And Stay Out! Blocking Backdoor Break-Ins

Backdoor access was the most common threat vector in 2022. According to the 2023 IBM Security X-Force Threat Intelligence Index, 21% of incidents saw the use of backdoors, outpacing perennial compromise favorite ransomware, which came in at just 17%. The good news? In 67% of backdoor attacks, defenders were able to disrupt attacker efforts and lock digital doorways before ransomware payloads were deployed. The not-so-great news? With backdoor access now available at a bargain price on the dark web, businesses…

© 2023 IBM Contact Privacy Terms of use Accessibility Cookie Preferences
Sponsored by si-icon-eightbarfeature