CVE-2025-5187

Executive Summary

CVE-2025-5187 is a privilege escalation vulnerability in the Kubernetes NodeRestriction admission controller. An authenticated node user can delete their own node object by setting an OwnerReference to a cluster-scoped resource (e.g., a ClusterRole or Namespace). If that referenced resource does not exist or is later deleted, Kubernetes garbage collection will remove the node object. This allows a compromised node to effectively self-destruct, evading monitoring and disrupting cluster operations. The vulnerability has a CVSS score of 6.7 (Medium) and currently has no known patch or public exploit.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a core Kubernetes admission controller issue. However, organizations using Kubernetes distributions (e.g., kubeadm, Rancher, OpenShift) should verify their vendor's patch status.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Local (requires node-level access)
• Attack Complexity: Low
• Privileges Required: High (node user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High (node deletion)
• Availability Impact: High (node deletion)

Threat Level: Medium. Exploitation requires node-level access, but the impact is significant—an attacker can delete a node, causing workload disruption and potentially covering tracks.

Deep Dive & Mechanics

The NodeRestriction admission controller is designed to limit what a node user (e.g., the kubelet) can modify. It prevents nodes from modifying other nodes or escalating privileges. However, CVE-2025-5187 bypasses this restriction by exploiting Kubernetes garbage collection.

Mechanism:

1. An attacker with node-level access (e.g., via a compromised kubelet) patches their own node object to add an OwnerReference pointing to a cluster-scoped resource (e.g., a ClusterRole named nonexistent-role).
2. The NodeRestriction controller does not validate the existence of the referenced resource, so the patch succeeds.
3. If the referenced resource does not exist, or if it is later deleted, Kubernetes garbage collection automatically deletes the node object.
4. The node is removed from the cluster, causing all pods on that node to be evicted and the node to become unavailable.

Root Cause: The NodeRestriction controller fails to check that the OwnerReference points to an existing resource. It also does not prevent node users from setting OwnerReference to cluster-scoped resources.

Vulnerable vs. Patched Code

Vulnerable Code (NodeRestriction admission controller):

// In the admission controller, when processing a node update:
if node.Spec.OwnerReferences != nil {
    // No validation of OwnerReference existence or scope
    // Allows any OwnerReference to be set
}

Patched Code (Hypothetical):

// Patched version should validate OwnerReference:
if node.Spec.OwnerReferences != nil {
    for _, ref := range node.Spec.OwnerReferences {
        // Check that the referenced resource exists and is namespaced
        if ref.APIVersion != "v1" || ref.Kind != "Node" {
            // Reject if not a namespaced resource
            return false, "OwnerReference must be to a namespaced resource"
        }
        // Verify resource exists
        _, err := client.Get(ref.APIVersion, ref.Kind, ref.Name)
        if err != nil {
            return false, "OwnerReference resource does not exist"
        }
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Node-level access (e.g., kubelet credentials or a pod with hostPID and hostNetwork).
• Ability to patch the node object (requires nodes/update permission, which kubelet typically has).

Exploitation Steps:

1. Obtain kubelet credentials or a token with node update permissions.
2. Use kubectl or the Kubernetes API to patch the node object:

   kubectl patch node <node-name> -p '{"metadata":{"ownerReferences":[{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","name":"nonexistent-role","uid":"fake-uid"}]}}'
   

3. The node will be deleted by garbage collection within minutes (default GC interval is 5 minutes).
4. Alternatively, if the referenced resource exists, delete it to trigger GC:

   kubectl delete clusterrole nonexistent-role
   

Expected Outcome: The node is removed from the cluster, and all pods on it are evicted.

Blue Team (Defender)

Detection:

• Monitor for node object patches that add OwnerReference fields.
• Alert on any node deletion events that are not initiated by an administrator.
• Use admission webhooks to block OwnerReference patches on node objects.

Mitigation:

• Restrict node update permissions to only necessary users.
• Enable audit logging for node modifications.
• Implement a mutating admission webhook that validates OwnerReference on node objects.

Indicators of Compromise (IOCs)

• Node Object Patch: A node object with an OwnerReference to a cluster-scoped resource (e.g., ClusterRole, ClusterRoleBinding, Namespace).
• Node Deletion Event: A node deletion event without a corresponding kubectl delete node command.
• Audit Log Entry: API audit logs showing a node patch with ownerReferences field.
• Garbage Collection Activity: Increased GC activity in the controller manager logs.

Detection Engineering

YARA Rule

rule CVE_2025_5187_NodeOwnerRef
{
    meta:
        description = "Detects Kubernetes node objects with OwnerReference to cluster-scoped resources"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5187"
    strings:
        $owner_ref = /"ownerReferences":\s*\[[^\]]*"apiVersion":\s*"[^"]*rbac\.authorization\.k8s\.io\/v1"/
        $cluster_scope = /"kind":\s*"(ClusterRole|ClusterRoleBinding|Namespace)"/
    condition:
        $owner_ref and $cluster_scope
}

Sigma Rule

title: Kubernetes Node Object OwnerReference Patch
id: 8a3f2c1e-5d7b-4a9c-8e6f-2b1d3c4a5e6f
status: experimental
description: Detects patching of a node object with an OwnerReference to a cluster-scoped resource
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5187
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        verb: patch
        objectRef.resource: nodes
        objectRef.subresource: ""
        responseStatus.code: 200
        requestObject.ownerReferences: exists
    condition: selection
falsepositives:
    - Legitimate node maintenance by cluster administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5187 Kubernetes Node OwnerReference Patch"; flow:to_server,established; content:"PATCH"; http_method; content:"/api/v1/nodes/"; http_uri; content:"ownerReferences"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Node Update Permissions: Ensure only the kubelet and authorized administrators can update node objects. Use RBAC to limit nodes/update to specific service accounts.
2. Enable Admission Webhooks: Deploy a mutating admission webhook that blocks any OwnerReference patches on node objects.
3. Monitor Audit Logs: Enable Kubernetes audit logging and alert on node patches with ownerReferences.

Long-Term Fix:

• Apply the official patch from Kubernetes when available (currently UNKNOWN).
• Upgrade to a patched version of Kubernetes (check vendor advisories).

Workaround:

• Use a validating admission webhook to reject node patches that add OwnerReference to cluster-scoped resources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert