Kubernetes Nil pointer dereference in KCM after v1 HPA patch request
Date: 2024-11
Affected: go/k8s.io/kubernetes
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-0793
CWE: CWE-20
CWE-476
CVSS: 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.


Mitigations:

Architectural layers (MAESTRO):