Vulnerability feed

Executive summary

The apple/container project's K8s plugin can let content from an untrusted Linux container run commands on the macOS host. The advisory rates this as High severity, and the vendor's recommendation is to upgrade apple/container to version 1.5.0, which contains the fix.

Technical summary

The flaw is an unfiltered merge of a cluster container's kubeconfig into the host kubeconfig, which lets an attacker who can write to /etc/kubernetes/admin.conf inside the cluster container plant an exec credential plugin that kubectl runs as the macOS host user. The advisory says the trigger is a later write-config or create --node-image run, and the attacker needs prior write access to the cluster container's filesystem through a compromised workload, a hostPath mount, or a tampered node image. Affected versions are stated as less than 1.5.0, with 1.5.0 as the patched version. The advisory states no CWE, no CVSS score, and no information on exploitation in the wild. Detection guidance is given as running kubectl config view --raw to check whether any cluster-related user has a non-empty exec or auth-provider entry. Workarounds are avoiding write-config against untrusted clusters and avoiding create --node-image with untrusted node images.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/apple/container/security/adv…/GHSA-44v5-vx46-ghv6

Score

No CVSS score published.

Affects

AppleApple Container