CVE-2022-31077
Medium
Description
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.
SeverityMedium
CVSS4.0
Exploit probability—
ProductLinuxfoundation Kubeedge
PublishedJun 27, 2022
First seenJun 27, 2022
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- linuxfoundation kubeedge1.9.3 or later
- github.com/kubeedge/kubeedge1.10.1, 1.9.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation kubeedge | v < 1.9.3, 1.10.0 | 1.9.3 |
| github.com/kubeedge/kubeedgeGo | 1.10.0 ≤ v < 1.10.1, v < 1.9.3 | 1.10.1, 1.9.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.