2 lines
2.6 KiB
JSON
2 lines
2.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Kubernetes","vendor":"Kubernetes","versions":[{"status":"affected","version":"v1.32.0 - v1.32.5"},{"status":"affected","version":"v1.33.0 - v1.33.1"}]}],"source":"jordan@liggitt.net"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation."},{"lang":"es","value":"Existe una vulnerabilidad en el controlador de admisión NodeRestriction que permite a los nodos eludir las comprobaciones de autorización de asignación dinámica de recursos. Cuando la función DynamicResourceAllocation está habilitada, el controlador valida correctamente los estados de las solicitudes de recursos durante las actualizaciones de estado de los pods, pero no realiza una validación equivalente durante su creación. Esto permite que un nodo comprometido cree pods espejo que acceden a recursos dinámicos no autorizados, lo que podría provocar una escalada de privilegios."}],"id":"CVE-2025-4563","lastModified":"2026-06-17T09:33:31.753","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"jordan@liggitt.net","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4563","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-06-23T15:57:05.350312Z","version":"2.0.3"}}]},"published":"2025-06-23T16:15:27.350","references":[{"source":"jordan@liggitt.net","url":"https://github.com/kubernetes/kubernetes/issues/132151"},{"source":"jordan@liggitt.net","url":"https://groups.google.com/g/kubernetes-security-announce/c/Zv84LMRuvMQ"}],"sourceIdentifier":"jordan@liggitt.net","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"jordan@liggitt.net","type":"Secondary"}]}
|