The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
12849C27-DD8A-4D84-92FD-3AB32B43742B
1.16.13
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
CC1FA454-87A3-480C-BB5E-A23086E2EA99
1.17.9
1.17.0
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
3E4009BA-8220-4B8E-8B4B-1ADA1680DD70
1.18.6
1.18.0
OR
CVSS Rating: Medium (5.5)  [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/CR:H/IR:H/AR:M](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/CR:H/IR:H/AR:M)

The `/etc/hosts` file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the `/etc/hosts` file, it could fill the storage space of the node and cause the node to fail.

### Am I vulnerable?

Any clusters allowing pods with sufficient privileges to write to their own `/etc/hosts` files are affected. This includes containers running with `CAP_DAC_OVERRIDE` in their capabilities bounding set (true by default) and either UID 0 (root) or a security context with `allowPrivilegeEscalation: true` (true by default).

#### Affected Versions

- kubelet v1.18.0-1.18.5
- kubelet v1.17.0-1.17.8
- kubelet < v1.16.13

### How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by using PodSecurityPolicies or other admission webhooks to force containers to drop CAP_DAC_OVERRIDE or to prohibit privilege escalation and running as root, but these measures may break existing workloads that rely upon these privileges to function properly.

#### Fixed Versions

- kubelet master - fixed by #92916
- kubelet v1.18.6 - fixed by #92921
- kubelet v1.17.9 - fixed by #92923
- kubelet v1.16.13 - fixed by #92924

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

### Detection

Large pod `etc-hosts` files may indicate that a pod is attempting to perform a Denial of Service attack using this bug. A command such as

```
find /var/lib/kubelet/pods/*/etc-hosts -size +1M
```

run on a node can be used to find abnormally large pod etc-hosts files.

#### Acknowledgements

This vulnerability was reported by Kebe Liu of DaoCloud, via the Kubernetes bug bounty program.

/area security
/kind bug
/committee product-security
/sig node
/area kubelet
CVE-2020-8557: Node disk DOS by writing to container /etc/hosts
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : CVE-2020-8557: Node disk DOS by writing to container /etc/hosts
Issue date:

--- start body ---
CVSS Rating: Medium (5.5)  [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/CR:H/IR:H/AR:M](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/CR:H/IR:H/AR:M)

The `/etc/hosts` file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the `/etc/hosts` file, it could fill the storage space of the node and cause the node to fail.

### Am I vulnerable?

Any clusters allowing pods with sufficient privileges to write to their own `/etc/hosts` files are affected. This includes containers running with `CAP_DAC_OVERRIDE` in their capabilities bounding set (true by default) and either UID 0 (root) or a security context with `allowPrivilegeEscalation: true` (true by default).

#### Affected Versions

- kubelet v1.18.0-1.18.5
- kubelet v1.17.0-1.17.8
- kubelet < v1.16.13

### How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by using PodSecurityPolicies or other admission webhooks to force containers to drop CAP_DAC_OVERRIDE or to prohibit privilege escalation and running as root, but these measures may break existing workloads that rely upon these privileges to function properly.

#### Fixed Versions

- kubelet master - fixed by #92916
- kubelet v1.18.6 - fixed by #92921
- kubelet v1.17.9 - fixed by #92923
- kubelet v1.16.13 - fixed by #92924

To upgrade, refer to the documentation: https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#upgrading-a-cluster

### Detection

Large pod `etc-hosts` files may indicate that a pod is attempting to perform a Denial of Service attack using this bug. A command such as

```
find /var/lib/kubelet/pods/*/etc-hosts -size +1M
```

run on a node can be used to find abnormally large pod etc-hosts files.

#### Acknowledgements

This vulnerability was reported by Kebe Liu of DaoCloud, via the Kubernetes bug bounty program.

/area security
/kind bug
/committee product-security
/sig node
/area kubelet
--- end body ---

comments :
--- start comments ---

--- end comments ---