NULL pointer dereference in Kubernetes Container Storage Interface Snapshotter
CVE-2020-8569
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected.
EPSS: 0.023 (81.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Kubernetes Container_storage_interface_snapshotter
- Kubernetes Csi Snapshotter — versions snapshot-controller v3.0, snapshot-controller v2.1
Weakness classification (CWE)
References
- jordan@liggitt.net (Mailing List, Third Party Advisory, x_refsource_MISC)
- jordan@liggitt.net (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-8569?
- CVE-2020-8569 is a medium-severity vulnerability in Kubernetes Container Storage Interface Snapshotter, classified under NULL Pointer Dereference. CVSS score: 4.3/10. Published 2021-01-21.
- How severe is CVE-2020-8569?
- Medium severity. CVSS v3 base score is 4.3 out of 10.