CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

This vulnerability allows containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) to access files/directories outside of the volume, including the host’s filesystem.

Thanks to Maxim Ivanov for reporting this problem.

Vulnerable versions:

• Kubernetes 1.3.x-1.6.x
• Kubernetes 1.7.0-1.7.13
• Kubernetes 1.8.0-1.8.8
• Kubernetes 1.9.0-1.9.3

Vulnerable configurations:

• Clusters that allow untrusted users to control pod spec content, and prevent host filesystem access via hostPath volumes (or other volume types) using PodSecurityPolicy (or custom admission plugins)
• Clusters that make use of subpath volume mounts with untrusted containers or containers that can be compromised

Vulnerability impact:
A specially crafted pod spec combined with malicious container behavior can allow read/write access to arbitrary files outside volumes specified in the pod, including the host’s filesystem. This can be accomplished with any volume type, including emptyDir, and can be accomplished with a non-privileged pod (subject to file permissions).

Mitigations prior to upgrading:
Prevent untrusted users from creating pods (and pod-creating objects like deployments, replicasets, etc), or disable all volume types with PodSecurityPolicy (note that this prevents use of service account tokens in pods, and requires use of automountServiceAccountToken: false)

Fixed versions:

• Fixed in v1.7.14 by [1.7] subpath fixes #61047
• Fixed in v1.8.9 by [1.8] subpath fixes #61046
• Fixed in v1.9.4 by [1.9] subpath fixes #61045
• Fixed in master by subpath fixes #61044 (included in v1.10.0-beta.3, will be in v1.10.0)

Action Required:
In addition to upgrading, PodSecurityPolicy objects designed to limit container permissions must completely disable hostPath volumes, as the allowedHostPaths feature does not restrict symlink creation and traversal. Future enhancements (tracked in issue #61043) are required to limit hostPath use to read only volumes or exact path matches before a PodSecurityPolicy can effectively restrict hostPath usage to a given subpath.

Known issues:

• Status and availability of fixes for regressions in subPath volume mount handling are tracked in subPath volume mount umbrella issue #61563