CVE-2018-1002105 — AI Deep Analysis Summary

🚨 **Essence**: A critical privilege escalation flaw in Kubernetes. The system fails to properly handle error responses during WebSocket upgrades.…

🛠️ **Root Cause**: Improper handling of error responses. Specifically, the API server does not correctly validate the WebSocket upgrade request context.…

📦 **Affected Versions**: • Kubernetes < 1.10.11 • Kubernetes < 1.11.5 • Kubernetes < 1.12.3 🏢 **Vendor**: Google Kubernetes Engine / Open Source Kubernetes.

💀 **Attacker Actions**: • **Privilege Escalation**: Gain unauthorized access to pods. • **Data Theft**: Dump secrets (credentials, keys) from the cluster.…

⚖️ **Threshold**: Medium-High. • **Auth Required**: Yes, typically requires `create` and `get` privileges on `pods` and `pods/exec`. • **Config**: Can be exploited via authenticated API calls.…

🔓 **Public Exploits**: YES. Multiple PoCs are available on GitHub (e.g., `gravitational/cve-2018-1002105`, `evict/poc_CVE-2018-1002105`). These tools can automatically check for vulnerability and even execute commands.

🔍 **Self-Check**: 1. Run the official test utility from Gravitational. 2. Check your Kubernetes version against the fixed versions. 3. Monitor API server logs for suspicious WebSocket upgrade requests.…

✅ **Official Fix**: YES. Patched in versions 1.10.11+, 1.11.5+, and 1.12.3+. Red Hat also issued advisories (RHSA-2018:3752, etc.) for their distributions.

🛡️ **No Patch Workaround**: • **Restrict Permissions**: Limit `pods/exec` and `pods/portforward` permissions in RBAC policies. • **Network Policies**: Block direct access to the API server from untrusted networks.…

🔥 **Urgency**: CRITICAL. This allows direct container escape and secret theft. If you are running an affected version, patch IMMEDIATELY. Do not wait for the next maintenance window.