CVE-2020-26278 (published 2021-01-20T22:15Z)

Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is supplied with a manifest that runs pods on every node in a Kubernetes cluster, which are responsible for managing network connections for all other pods in the cluster. This requires a lot of power over the host, and the manifest sets `privileged: true`, which gives it that power. It also set `hostPID: true`, which gave it the ability to access all other processes on the host, and write anywhere in the root filesystem of the host. This setting was not necessary, and is being removed. You are only vulnerable if you have an additional vulnerability (e.g. a bug in Kubernetes) or misconfiguration that allows an attacker to run code inside the Weave Net pod, No such bug is known at the time of release, and there are no known instances of this being exploited. Weave Net 2.8.0 removes the hostPID setting and moves CNI plugin install to an init container. Users who do not update to 2.8.0 can edit the hostPID line in their existing DaemonSet manifest to say false instead of true, arrange some other way to install CNI plugins (e.g. Ansible) and remove those mounts from the DaemonSet manifest.

Severity: HIGH
CVSS v2 base score: 7.9 (AV:A/AC:M/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 8.0, HIGH (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-250
cwe_name: Execution with Unnecessary Privileges
description: The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
extended_description: 
            New weaknesses can be exposed because running with extra privileges, such as root or Administrator, can disable the normal security checks being performed by the operating system or surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if they occur while operating at raised privileges.
            Privilege management functions can behave in some less-than-obvious ways, and they have different quirks on different platforms. These inconsistencies are particularly pronounced if you are transitioning from one non-root user to another. Signal handlers and spawned processes run at the privilege of the owning process, so if a process is running as root when a signal fires or a sub-process is executed, the signal handler or sub-process will operate with root privileges.
         
         

Fix information:
repo_url: https://github.com/weaveworks/weave
commit_details: repo_url: https://github.com/weaveworks/weave
author: Bryan Boreham
author_date: 2020-12-10 17:38:53+00:00
msg: Stop running in host PID namespace

We shouldn't need this
repository: repo_url: https://github.com/weaveworks/weave
repo_name: weaveworks/weave
description: Simple, resilient multi-host containers networking and more.
repo_language: Go
owner: weaveworks
file_changes: filename: weave-daemonset-k8s-1.11.yaml
change_type: ModificationType.MODIFY
diff: @@ -177,7 +177,7 @@ items:
                   readOnly: false
           hostNetwork: true
           dnsPolicy: ClusterFirstWithHostNet
-          hostPID: true
+          hostPID: false
           restartPolicy: Always
           securityContext:
             seLinuxOptions: {}

programming_language: CoffeeScript
filename: weave-daemonset-k8s-1.6.yaml
change_type: ModificationType.MODIFY
diff: @@ -148,7 +148,7 @@ items:
               securityContext:
                 privileged: true
           hostNetwork: true
-          hostPID: true
+          hostPID: false
           restartPolicy: Always
           securityContext:
             seLinuxOptions: {}

programming_language: CoffeeScript
filename: weave-daemonset-k8s-1.7.yaml
change_type: ModificationType.MODIFY
diff: @@ -164,7 +164,7 @@ items:
                   mountPath: /run/xtables.lock
                   readOnly: false
           hostNetwork: true
-          hostPID: true
+          hostPID: false
           restartPolicy: Always
           securityContext:
             seLinuxOptions: {}

programming_language: CoffeeScript
filename: weave-daemonset-k8s-1.8.yaml
change_type: ModificationType.MODIFY
diff: @@ -173,7 +173,7 @@ items:
                   mountPath: /run/xtables.lock
                   readOnly: false
           hostNetwork: true
-          hostPID: true
+          hostPID: false
           restartPolicy: Always
           securityContext:
             seLinuxOptions: {}

programming_language: CoffeeScript
filename: weave-daemonset-k8s-1.9.yaml
change_type: ModificationType.MODIFY
diff: @@ -177,7 +177,7 @@ items:
                   readOnly: false
           hostNetwork: true
           dnsPolicy: ClusterFirstWithHostNet
-          hostPID: true
+          hostPID: false
           restartPolicy: Always
           securityContext:
             seLinuxOptions: {}

programming_language: CoffeeScript