KubeEdge Cloud Stream and Edge Stream DoS from large stream message
CVE-2022-31079

4.4MEDIUM

Key Information:

Vendor

Kubeedge

Status
Kubeedge
Vendor
CVE Published:
11 July 2022

What is CVE-2022-31079?

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size of this message. An attacker can exploit this by sending a large message to exhaust memory and cause a DoS. The Cloud Stream server and the Edge Stream server are under DoS attack in this case. The consequence of the exhaustion is that the CloudCore and EdgeCore will be in a denial of service. Only an authenticated user can cause this issue. It will be affected only when users enable cloudStream module in the config file cloudcore.yaml and enable edgeStream module in the config file edgecore.yaml. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4. As a workaround, disable cloudStream module in the config file cloudcore.yaml and disable edgeStream module in the config file edgecore.yaml.

Affected Version(s)

kubeedge = 1.11.0 = 1.11.0

kubeedge >= 1.10.0, < 1.10.2 < 1.10.0, 1.10.2

kubeedge < 1.9.4 < 1.9.4

References

https://github.com/kubeedge/kubeedge/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.