Read the docs
TI-2023-02285 Aliases CVE-2023-2431GHSA-xc8m-28vv-4pjc

Bypass of seccomp profile enforcement

Priority MEDIUM 58CWE-1287Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 1 fixed, 9 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00257 17th percentileScored 2026-11-07
Fix Partial Kubernetes (Kubernetes): v1.24.14, v1.25.9, v1.26.4 +1k8s.io/kubernetes (Go): 1.24.14, 1.25.10, 1.26.5 +1Red Hat: 1 advisoryRed Hat: 1 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesbefore v1.24.14; v1.25.0 to before v1.25.9; v1.26.0 to before v1.26.4; v1.27.0 to before v1.27.1v1.24.14, v1.25.9, v1.26.4, v1.27.1Patch availableCNA
—k8s.io/kubernetes (Go)before 1.24.141.24.14Patch availableGHSA-xc8m-28vv-4pjc
—k8s.io/kubernetes (Go)1.25.0 to before 1.25.101.25.10Patch availableGHSA-xc8m-28vv-4pjc
—k8s.io/kubernetes (Go)1.26.0 to before 1.26.51.26.5Patch availableGHSA-xc8m-28vv-4pjc
—k8s.io/kubernetes (Go)1.27.0 to before 1.27.21.27.2Patch availableGHSA-xc8m-28vv-4pjc
  • Kubernetes VendorKubernetes Affected before v1.24.14; v1.25.0 to before v1.25.9; v1.26.0 to before v1.26.4; v1.27.0 to before v1.27.1 Fixed in v1.24.14, v1.25.9, v1.26.4, v1.27.1 Patch available CNA
  • k8s.io/kubernetes (Go) Vendor— Affected before 1.24.14 Fixed in 1.24.14 Patch available GHSA-xc8m-28vv-4pjc
  • k8s.io/kubernetes (Go) Vendor— Affected 1.25.0 to before 1.25.10 Fixed in 1.25.10 Patch available GHSA-xc8m-28vv-4pjc
  • k8s.io/kubernetes (Go) Vendor— Affected 1.26.0 to before 1.26.5 Fixed in 1.26.5 Patch available GHSA-xc8m-28vv-4pjc
  • k8s.io/kubernetes (Go) Vendor— Affected 1.27.0 to before 1.27.2 Fixed in 1.27.2 Patch available GHSA-xc8m-28vv-4pjc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*before 1.24.14; 1.25.0 to before 1.25.10; 1.26.0 to before 1.26.5; 1.27.0 to before 1.27.2VulnerableKubernetes
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions before 1.24.14; 1.25.0 to before 1.25.10; 1.26.0 to before 1.26.5; 1.27.0 to before 1.27.2 Vulnerable ·Kubernetes
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA Kubernetes (Kubernetes) Fixed in v1.24.14, v1.25.9, v1.26.4, v1.27.1
  • Fix · GHSA-xc8m-28vv-4pjc k8s.io/kubernetes (Go) Fixed in 1.24.14 Advisory →
  • Fix · GHSA-xc8m-28vv-4pjc k8s.io/kubernetes (Go) Fixed in 1.25.10 Advisory →
  • Fix · GHSA-xc8m-28vv-4pjc k8s.io/kubernetes (Go) Fixed in 1.26.5 Advisory →
  • Fix · GHSA-xc8m-28vv-4pjc k8s.io/kubernetes (Go) Fixed in 1.27.2 Advisory →

Red Hat 1 advisory

  • RHSA-2023:6156 Released 2023-10-30 · Red Hat rating Important
    Red Hat OpenShift support for Windows Containers 8.1.0 security update
    • Red Hat OpenShift Container Platform 4.13 openshift4-wincw/windows-machine-config-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift API for Data ProtectionAffectedNo fix yet: Fix deferred
OpenShift ServerlessAffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Security 3AffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Security 4AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift GitOpsAffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 16.2AffectedNo fix yet: Fix deferred
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2023:6156
Not affected: 7 products
  • CloudForms Management Engine 5
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift GitOps
  • Red Hat Openshift Data Foundation 4
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2431
  2. 2026-10-03 Alias added: GHSA-xc8m-28vv-4pjc

References

Advisory 1

Other 13

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
  • TI-2019-08423 Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack CVSS 3.1HIGH 7.5
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences