Node disk DOS by writing to container /etc/hosts
该报告还没有中文解读。
原文摘录
摘自原文（3692 字符中的一小部分）
Summary: Pod files /etc/hosts, /etc/hostname, /etc/resolve.conf are not readonly. A normal pod running in kubernetes cluster can kil a host through write data to /etc/hosts. Not only /etc/hosts, but also /etc/resolve.conf and /etc/hostname can do this.
原文中的代码
[root@kebe-sm-315 ~]# kubectl exec -it rate-c848c5c8b-5b8vm sh kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl kubectl exec [POD] -- [COMMAND] instead. Defaulting container name to rate. Use 'kubectl describe pod/rate-c848c5c8b-5b8vm -n default' to …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Kubernetes 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @kebe · 版权归作者与 Kubernetes 所有