CVE-2022-36103 : Security Advisory and Response

Talos worker join token can be used to get elevated access level to the Talos API

Understanding CVE-2022-36103

This CVE affects Talos Linux, a distribution designed for Kubernetes deployments. A vulnerability in the validation process of worker node CSR could lead to unauthorized access to the Talos API.

What is CVE-2022-36103?

Talos Linux worker nodes utilize a join token to join the cluster, but a flaw in the validation process allows unauthorized access to the Talos API on control plane nodes. This could compromise sensitive information and grant unauthorized access to the cluster.

The Impact of CVE-2022-36103

The vulnerability could result in high confidentiality, integrity, and availability impacts. Unauthorized access to the Talos API on control plane nodes could lead to full access to the cluster, jeopardizing Kubernetes and Talos PKI security.

Technical Details of CVE-2022-36103

This vulnerability has a CVSS v3.1 base score of 7.2, indicating a high severity level with low attack complexity and network-based vector.

Vulnerability Description

Improper validation of the worker node CSR could result in the issuance of a Talos API certificate, providing unauthorized access to the cluster.

Affected Systems and Versions

The vulnerability impacts Talos versions below 1.2.2.

Exploitation Mechanism

Unauthorized access to the Talos API on control plane nodes could reveal sensitive information and grant full access to the cluster.

Mitigation and Prevention

To mitigate the CVE-2022-36103 vulnerability, upgrade Talos to version 1.2.2. Additionally, enabling Pod Security Standards can help by denying certain mounts and networking by default.

Immediate Steps to Take

Update Talos to version 1.2.2 and review Pod Security Standards to prevent unauthorized access.

Long-Term Security Practices

Ensure correct Pod Security configurations to disallow certain mounts and securely access cloud metadata servers.

Patching and Updates

Regularly monitor and apply security updates to Talos to prevent vulnerabilities.