Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutation
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 1.8%
exploitation probability
1.8%top 24% of all CVEs
observed exploitation
nono source reports it
Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
Affected products
Kubernetes · kubernetes-csi external-provisionerKubernetes · kubernetes-csi external-resizerKubernetes · kubernetes-csi external-snapshotterReferences
https://access.redhat.com/errata/RHSA-2019:4054https://access.redhat.com/errata/RHSA-2019:4096https://access.redhat.com/errata/RHSA-2019:4099https://access.redhat.com/errata/RHSA-2019:4225https://github.com/kubernetes/kubernetes/issues/85233https://groups.google.com/forum/#%21topic/kubernetes-security-announce/aXiYN0q4uIwhttps://security.netapp.com/advisory/ntap-20200810-0003/