突破边界：揭秘Kubernetes操作符中的跨命名空间引用漏洞
Breaking the Bulkhead: Demystifying Cross-Namespace Reference Vulnerabilities in Kubernetes Operators
AI总结：
本文首次系统研究Kubernetes操作符攻击，揭示跨命名空间引用漏洞及其影响，提出缓解措施并发现14%的操作符可能受威胁。
摘要：
Kubernetes操作符是设计用于在Kubernetes集群中管理应用程序生命周期的自动化工具，扩展了Kubernetes的功能，并减少了对人类工程师的操作负担。虽然操作符显著简化了DevOps工作流程，但它们也引入了新的安全风险。特别是，Kubernetes通过命名空间隔离来分离工作负载并限制用户访问，确保用户只能与他们授权的命名空间中的资源进行交互。然而，Kubernetes操作符往往需要提升的权限，并且可能与多个命名空间中的资源进行交互。这引入了一种新的漏洞类别，即跨命名空间引用漏洞。根本原因在于资源声明范围与操作符逻辑实现范围之间的不匹配，导致Kubernetes无法正确隔离命名空间。利用此类漏洞，一个仅对单个授权命名空间有访问权限的攻击者可以利用操作符执行影响其他未经授权命名空间的操作，导致特权提升和进一步的影响。据我们所知，本文是首次系统地研究Kubernetes操作符攻击。我们提出了跨命名空间引用漏洞，并展示了攻击者如何绕过命名空间隔离的两种策略。通过大规模测量，我们发现野生中的超过14%的操作符可能易受攻击。我们的发现已报告给相关开发者，截至提交时，已获得8次确认和7个CVE，影响了包括Red Hat和NVIDIA在内的供应商，突显了在Kubernetes操作符中加强安全实践的紧迫性。为缓解此问题，我们开源了静态分析套件，并提出了具体的缓解措施以造福生态系统。
英文摘要：
Kubernetes Operators, automated tools designed to manage application lifecycles within Kubernetes clusters, extend the functionalities of Kubernetes, and reduce the operational burden on human engineers. While Operators significantly simplify DevOps workflows, they introduce new security risks. In particular, Kubernetes enforces namespace isolation to separate workloads and limit user access, ensuring that users can only interact with resources within their authorized namespaces. However, Kubernetes Operators often demand elevated privileges and may interact with resources across multiple namespaces. This introduces a new class of vulnerabilities, the Cross-Namespace Reference Vulnerability. The root cause lies in the mismatch between the declared scope of resources and the implemented scope of the Operator logic, resulting in Kubernetes being unable to properly isolate the namespace. Leveraging such vulnerability, an adversary with limited access to a single authorized namespace may exploit the Operator to perform operations affecting other unauthorized namespaces, causing Privilege Escalation and further impacts. To the best of our knowledge, this paper is the first to systematically investigate Kubernetes Operator attacks. We present Cross-Namespace Reference Vulnerability with two strategies, demonstrating how an attacker can bypass namespace isolation. Through large-scale measurements, we found that over 14% of Operators in the wild are potentially vulnerable. Our findings have been reported to the relevant developers, resulting in 8 confirmations and 7 CVEs by the time of submission, affecting vendors including Red Hat and NVIDIA, highlighting the critical need for enhanced security practices in Kubernetes Operators. To mitigate it, we open-source the static analysis suite and propose concrete mitigation to benefit the ecosystem.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
