CVE-2023-1943
📋 TL;DR
This vulnerability allows attackers to escalate privileges in kOps clusters using the GCE/GCP provider in gossip mode. Attackers can gain cluster-admin privileges by exploiting improper access controls in the gossip protocol implementation. This affects kOps users running on Google Cloud Platform with gossip mode enabled.
💻 Affected Systems
- kOps (Kubernetes Operations)
📦 What is this software?
Operations by Kubernetes
Operations by Kubernetes
⚠️ Risk & Real-World Impact
Worst Case
Full cluster compromise with attacker gaining cluster-admin privileges, allowing them to deploy malicious workloads, exfiltrate sensitive data, or disrupt operations.
Likely Case
Privilege escalation to cluster-admin level, enabling unauthorized access to cluster resources and potential lateral movement within the environment.
If Mitigated
Limited impact with proper network segmentation and access controls, though privilege escalation within the cluster boundary remains possible.
🎯 Exploit Status
Exploitation requires network access to the gossip endpoint and knowledge of the gossip protocol. No authentication is required once network access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: kOps 1.26.3, 1.25.8, 1.24.12, 1.23.18
Vendor Advisory: https://groups.google.com/g/kubernetes-security-announce/c/yrCE1x89oaU
Restart Required: Yes
Instructions:
1. Update kOps to patched version. 2. Update cluster using 'kops update cluster --yes'. 3. Perform rolling update with 'kops rolling-update cluster --yes'. 4. Verify all nodes are running updated kOps version.
🔧 Temporary Workarounds
Disable Gossip Mode
linuxSwitch from gossip mode to non-gossip configuration for GCE/GCP provider
kops edit cluster
Change gossip configuration to non-gossip mode
kops update cluster --yes
kops rolling-update cluster --yes
Network Segmentation
allRestrict network access to gossip protocol endpoints
Configure firewall rules to limit access to gossip ports (typically 3997-3999)
Implement network policies to restrict gossip traffic
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to restrict access to gossip protocol endpoints
- Monitor for unauthorized access attempts to gossip ports and review cluster-admin role assignments regularly
🔍 How to Verify
Check if Vulnerable:
Check if using GCE/GCP provider with gossip mode: 'kops get cluster' and inspect configuration. Check kOps version: 'kops version'.Check Version:
kops versionVerify Fix Applied:
Verify kOps version is 1.26.3, 1.25.8, 1.24.12, or 1.23.18: 'kops version'. Confirm gossip mode is disabled or network restricted.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to gossip ports (3997-3999)
- Unexpected cluster-admin role assignments
- Suspicious API server requests from gossip network
Network Indicators:
- Unusual traffic to gossip protocol ports from unauthorized sources
- Network connections to gossip endpoints from unexpected IP ranges
SIEM Query:
source_port:3997-3999 AND (NOT source_ip:authorized_range) OR event:"cluster-admin" AND user:unexpected_user