Microsoft Azure Kubernetes Service 机密容器权限提升漏洞

Successful exploitation of CVE-2024-21400 could allow an attacker to gain unauthorized access to sensitive data and resources within the Azure Kubernetes Service environment. An attacker could potentially compromise confidential containers, bypassing security measures designed to protect sensitive workloads. This could lead to data breaches, disruption of services, and further lateral movement within the cluster. The impact is particularly severe given the intended purpose of Confidential Containers – to isolate workloads and protect data in use.

Organizations heavily reliant on Azure Kubernetes Service Confidential Containers for protecting sensitive workloads are at significant risk. This includes those deploying regulated data (e.g., HIPAA, PCI DSS) or handling intellectual property. Environments with misconfigured Kubernetes clusters or lacking robust network segmentation are particularly vulnerable.

• kubernetes / server:

kubectl get pods -l aks.microsoft.com/confidential=true -o wide | grep 'Version:'

• kubernetes / server:

kubectl describe pod <pod-name> | grep 'Confidential Container Runtime Version:'

• kubernetes / server:

# Check for unusual pod configurations or resource requests
kubectl get pods --all-namespaces -o yaml | grep -i 'confidential'

1. 2024-03-12Disclosure

   disclosure

1. 已保留2023-12-08
2. 发布日期2024-03-12
3. 修改日期2025-05-03
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-21400 is to upgrade Azure Kubernetes Service Confidential Containers to version 0.3.3 or later. If immediate upgrade is not possible, consider implementing stricter network policies and access controls within your Kubernetes cluster to limit the potential blast radius of a successful attack. Regularly review and audit your Kubernetes configurations to identify and address any potential misconfigurations that could be exploited. After upgrade, confirm by verifying the version of the Confidential Container runtime.