title: Kubernetes node disk Denial of Service by writing to container /etc/hosts
description: The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
product: Kubernetes
vendor: Kubernetes
versions:
status: affected, version: 1.15
status: affected, version: 1.14
status: affected, version: 1.13
status: affected, version: 1.12
status: affected, version: 1.11
status: affected, version: 1.10
status: affected, version: 1.9
status: affected, version: 1.8
status: affected, version: 1.7
status: affected, version: 1.6
status: affected, version: 1.5
status: affected, version: 1.4
status: affected, version: 1.3
status: affected, version: 1.2
status: affected, version: 1.1
lessThan: 1.18.6, status: affected, version: 1.18, versionType: custom
lessThan: 1.17.9, status: affected, version: 1.17, versionType: custom
lessThan: 1.16.13, status: affected, version: 1.16, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]