CVE-2022-31077CWE-476

Malicious response from KubeEdge can crash CSI Driver controller server

Medium · published June 27, 2022

CVSS v3.1
4.0
EPSS
1%
Percentile
56.8
In the wild
Unconfirmed
What it is

KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00819 · 56.8th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2022-06-27T20:10Z
EPSS history
Timeline
  • 27 JUN 20:10Z
    Malicious response from KubeEdge can crash CSI Driver controller server
    cvelistv5