● CVE-2024-5321 / High Severity

CVE-2024-5321: Kubernetes Kube-apiserver Authorization Bypass Teardown

How an aggregated API server context desync in k8s.io/apiserver allowed namespace-limited users to bypass RBAC and execute cluster-admin actions.

💡 通俗通俗化解析 (ELI5)

Imagine a shared building where you only have a key to Apartment 4. You go to the front desk and ask for maintenance service. The receptionist forgets to write your apartment number on the work order. The maintenance staff assumes the work order is for the penthouse suite, letting you walk right into the master control room of the entire building.

核心概念与底层架构术语

kube-apiserver: The central management gateway for all Kubernetes cluster operations, enforcing authentication and RBAC authorization.
Aggregated API Servers: Extension API servers mounted into the main Kubernetes API tree to serve custom resource definitions (CRDs).
RBAC (Role-Based Access Control): Kubernetes authorization policy regulating access to compute, storage, and networking resources based on roles.
ClusterRoleBinding: Assigning administrative permissions cluster-wide across all namespaces.

攻击利用全流程逐步拆解

Step 1

1. Namespace-Restricted Access

An attacker has access only to a low-privileged namespace (e.g. dev).

Step 2

2. Sending Aggregated API Request

The attacker issues a request to an aggregated API endpoint omitting namespace parameters.

Step 3

3. Context Stripping Desync

The API proxy misinterprets the empty namespace as an authorization request for cluster-wide scope.

Step 4

4. Full Cluster Privilege Escalation

The attacker accesses cluster secrets and mounts host root volumes across all worker nodes.

源码对比：致命缺陷 vs. 加固补丁

采用清晰易读的高级编程语言展示（不含晦涩汇编或二进制机器码）。

未修补缺陷代码

// VULNERABLE: k8s.io/apiserver/pkg/endpoints/request/context.go
func NamespaceValue(ctx context.Context) string {
    // ROOT CAUSE:
    // If request context lacks explicit namespace header,
    // returns empty string ("") which aggregated handlers interpret as CLUSTER-SCOPED!
    val, ok := ctx.Value(namespaceKey).(string)
    if !ok {
        return "" // Inadvertently grants cluster-scoped evaluation!
    }
    return val;
}

安全加固补丁

// SECURE: k8s.io/apiserver/pkg/endpoints/request/context.go patch
func NamespaceValue(ctx context.Context) (string, error) {
    val, ok := ctx.Value(namespaceKey).(string)
    
    // 1. Explicitly reject missing namespace for namespace-scoped endpoints
    if !ok || val == "" {
        return "", fmt.Errorf("authorization context: namespace cannot be empty")
    }
    
    // 2. Return strictly verified namespace identifier
    return val, nil
}

工程落地与系统加固清单

Never treat empty namespace strings as valid cluster-scoped authorization credentials.
Audit all aggregated API servers and Custom Resource Definitions (CRDs) for authorization context parity.
Enforce least-privilege RBAC roles and avoid granting wildcard verbs (`*`) in RoleBindings.
Update Kubernetes control plane components (`kube-apiserver`) across all clusters immediately.

← 浏览完整安全目录所有平台安全更新 →