CVE-2019-11245 MEDIUM

CVE-2019-11245: kubelet-started container uid changes to root after first restart or if image is already pulled to the node

Vendor Kubernetes
Product Kubernetes
Weakness CWE-703
Published August 29, 2019
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.

Key dates

02Disclosure timeline

August 29, 2019 CVE published
September 16, 2024 Record updated