A security issue was discovered in Kubernetes where a user
 that can create pods on Windows nodes may be able to escalate to admin 
privileges on those nodes. Kubernetes clusters are only affected if they
 include Windows nodes.

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
A2572D17-1DE6-457B-99CC-64AFD54487EA
OR
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
FF4C81ED-BB69-490B-BABA-89C2501A5E6D
1.24.17
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
86AE4580-37A1-4E7B-9B7A-A30316676065
1.25.13
1.25.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
99BCE3D9-3EFA-4358-B36E-47954DBE28D4
1.26.8
1.26.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
3F30AD24-3FA9-4FA8-BCD5-5351EA357B49
1.27.5
1.27.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
A3FAE518-D5F9-4A7D-A703-1D36EA8A563C
1.28.1
1.28.0
OR
AND
CVSS Rating: [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - **HIGH** (8.8)

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

### Am I vulnerable?

Any kubernetes environment with Windows nodes is impacted.  Run `kubectl get nodes -l kubernetes.io/os=windows` to see if any Windows nodes are in use.

#### Affected Versions

- kubelet <= v1.28.0
- kubelet <= v1.27.4
- kubelet <= v1.26.7
- kubelet <= v1.25.12
- kubelet <= v1.24.16

### How do I mitigate this vulnerability?

The provided patch fully mitigates the vulnerability and has no known side effects.  Full mitigation for this class of issues requires patches applied for CVE-2023-3676, CVE-2023-3955, and CVE-2023-3893.

Outside of applying the provided patch, there are no known mitigations to this vulnerability.

#### Fixed Versions

- kubelet master - fixed by #120127
- kubelet v1.28.1 - fixed by #120129
- kubelet v1.27.5 - fixed by #120130
- kubelet v1.26.8 - fixed by #120131
- kubelet v1.25.13 - fixed by #120132
- kubelet v1.24.17 - fixed by #120133

To upgrade, refer to the documentation:
https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/

### Detection

Kubernetes audit logs can be used to detect if this vulnerability is being exploited. Pod create events with embedded powershell commands are a strong indication of exploitation. Config maps and secrets that contain embedded powershell commands and are mounted into pods are also a strong indication of exploitation.

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

#### Acknowledgements

This vulnerability was reported by Tomer Peled @tomerpeled92

The issue was fixed and coordinated by the fix team: 

James Sturtevant @jsturtevant
Mark Rossetti @marosset
Andy Zhang @andyzhangx
Justin Terry @jterry75
Kulwant Singh @KlwntSingh
Micah Hausler @micahhausler
Rita Zhang @ritazh

and release managers:

Jeremy Rickard @jeremyrickard


/triage accepted
/lifecycle frozen
/area security
/kind bug
/committee security-response
CVE-2023-3676: Insufficient input sanitization on Windows nodes leads to privilege escalation
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2023-3676: Insufficient input sanitization on Windows nodes leads to privilege escalation
Issue date:

--- start body ---
CVSS Rating: [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) - **HIGH** (8.8)

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes.

### Am I vulnerable?

Any kubernetes environment with Windows nodes is impacted.  Run `kubectl get nodes -l kubernetes.io/os=windows` to see if any Windows nodes are in use.

#### Affected Versions

- kubelet <= v1.28.0
- kubelet <= v1.27.4
- kubelet <= v1.26.7
- kubelet <= v1.25.12
- kubelet <= v1.24.16

### How do I mitigate this vulnerability?

The provided patch fully mitigates the vulnerability and has no known side effects.  Full mitigation for this class of issues requires patches applied for CVE-2023-3676, CVE-2023-3955, and CVE-2023-3893.

Outside of applying the provided patch, there are no known mitigations to this vulnerability.

#### Fixed Versions

- kubelet master - fixed by #120127
- kubelet v1.28.1 - fixed by #120129
- kubelet v1.27.5 - fixed by #120130
- kubelet v1.26.8 - fixed by #120131
- kubelet v1.25.13 - fixed by #120132
- kubelet v1.24.17 - fixed by #120133

To upgrade, refer to the documentation:
https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/

### Detection

Kubernetes audit logs can be used to detect if this vulnerability is being exploited. Pod create events with embedded powershell commands are a strong indication of exploitation. Config maps and secrets that contain embedded powershell commands and are mounted into pods are also a strong indication of exploitation.

If you find evidence that this vulnerability has been exploited, please contact security@kubernetes.io

#### Acknowledgements

This vulnerability was reported by Tomer Peled @tomerpeled92

The issue was fixed and coordinated by the fix team: 

James Sturtevant @jsturtevant
Mark Rossetti @marosset
Andy Zhang @andyzhangx
Justin Terry @jterry75
Kulwant Singh @KlwntSingh
Micah Hausler @micahhausler
Rita Zhang @ritazh

and release managers:

Jeremy Rickard @jeremyrickard


/triage accepted
/lifecycle frozen
/area security
/kind bug
/committee security-response
--- end body ---

comments :
--- start comments ---

--- end comments ---