CVE-2022-3162
Summary
| CVE | CVE-2022-3162 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-03-01 19:15:00 UTC |
| Updated | 2023-05-11 15:15:00 UTC |
| Description | Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Kubernetes | Kubernetes | All | All | All | All |
| Application | Kubernetes | Kubernetes | All | All | All | All |
| Application | Kubernetes | Kubernetes | All | All | All | All |
| Application | Kubernetes | Kubernetes | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CVE-2022-3162 Kubernetes Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| [Security Advisory] CVE-2022-3162: Unauthorized read of Custom Resources | MLIST | groups.google.com | |
| CVE-2022-3162: Unauthorized read of Custom Resources · Issue #113756 · kubernetes/kubernetes · GitHub | CONFIRM | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Richard Turnbull of NCC Group
Legacy QID Mappings
- 160338 Oracle Enterprise Linux Security Update for kubernetes (ELSA-2022-10034)
- 160339 Oracle Enterprise Linux Security Update for kubernetes (ELSA-2022-10035)
- 160340 Oracle Enterprise Linux Security Update for kubernetes (ELSA-2022-10033)
- 160341 Oracle Enterprise Linux Security Update for kubernetes (ELSA-2022-10036)
- 181205 Debian Security Update for kubernetes (CVE-2022-3162)
- 241070 Red Hat OpenShift Container Platform 4.12 Security Update (RHSA-2022:7398)
- 241196 Red Hat OpenShift Container Platform 4.12 Security Update (RHSA-2023:0772)
- 283329 Fedora Security Update for kubernetes (FEDORA-2022-2004702d98)
- 283408 Fedora Security Update for kubernetes (FEDORA-2022-8647729ff8)
- 377844 Kubernetes Unauthorized Read of Custom Resources Vulnerability
- 754042 SUSE Enterprise Linux Security Update for kubernetes1.23 (SUSE-SU-2023:2292-1)
- 770172 Red Hat OpenShift Container Platform 4.12 Security Update (RHSA-2022:7398)
- 770177 Red Hat OpenShift Container Platform 4.12 Security Update (RHSA-2023:0772)
- 905698 Common Base Linux Mariner (CBL-Mariner) Security Update for kube-vip-cloud-provider (13782)
- 905699 Common Base Linux Mariner (CBL-Mariner) Security Update for keda (13781)
- 905700 Common Base Linux Mariner (CBL-Mariner) Security Update for rook (13783)
- 905702 Common Base Linux Mariner (CBL-Mariner) Security Update for cert-manager (13780)
- 906939 Common Base Linux Mariner (CBL-Mariner) Security Update for cert-manager (13780-1)