Kubernetes kubelet beliebige Befehlsausführung in k8s.io/kubernetes

The impact of CVE-2024-10220 is severe. Successful exploitation allows an attacker to gain command execution on the Kubernetes node. This can be leveraged to steal sensitive data, install malware, disrupt services, or pivot to other nodes within the cluster. The attacker could potentially gain control of the entire Kubernetes environment, leading to widespread data breaches and operational outages. This vulnerability shares similarities with other kubelet-related vulnerabilities, highlighting the importance of timely patching and security hardening.

Organizations heavily reliant on Kubernetes for container orchestration are at significant risk. This includes cloud-native application deployments, microservices architectures, and any environment utilizing Kubernetes for managing containerized workloads. Specifically, clusters running older, unpatched versions of Kubernetes are particularly vulnerable.

• linux / server:

journalctl -u kubelet -g "arbitrary command execution"

• linux / server:

ps aux | grep kubelet | grep -i "malicious_command"

• generic web:

curl -I <kubelet_api_endpoint> | grep -i "CVE-2024-10220"

1. 2024-11-27Disclosure

   disclosure

1. Reserviert2024-10-21
2. Veröffentlicht2024-11-27
3. Geändert2026-02-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-10220 is to upgrade your Kubernetes cluster to version 1.28.12 or later. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting network access to the kubelet API server. Review and strengthen RBAC policies to limit the permissions granted to service accounts. Monitor kubelet logs for suspicious activity and consider implementing network policies to isolate critical nodes. After upgrading, confirm the fix by verifying the kubelet version using kubectl version and checking the Kubernetes audit logs for any unauthorized command executions.