CVE-2021-25749: Kubernetes Privilege Escalation Flaw

CVE-2021-25749 Overview

CVE-2021-25749 is a privilege escalation vulnerability in Kubernetes that allows Windows workloads to run as ContainerAdministrator even when those workloads explicitly set the runAsNonRoot option to true. This security control bypass undermines a fundamental container security mechanism designed to prevent containers from running with elevated privileges.

Critical Impact

Attackers can bypass the runAsNonRoot security constraint on Windows containers, potentially gaining ContainerAdministrator privileges to compromise containerized workloads and the underlying Kubernetes infrastructure.

Affected Products

• Kubernetes (all affected versions on Windows nodes)
• Kubernetes clusters with Windows worker nodes
• Windows-based container workloads relying on runAsNonRoot security controls

Discovery Timeline

• 2023-05-24 - CVE CVE-2021-25749 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-25749

Vulnerability Analysis

This vulnerability represents an Improper Access Control issue (CWE-284) in Kubernetes' handling of Windows container security contexts. The core problem lies in how Kubernetes validates and enforces the runAsNonRoot security policy for Windows workloads.

When administrators configure a Pod or container with runAsNonRoot: true in the security context, Kubernetes should prevent the container from running as the root user (or ContainerAdministrator on Windows). However, due to this vulnerability, Windows containers can bypass this restriction and execute with ContainerAdministrator privileges regardless of the security configuration.

The local attack vector requires an attacker to have some level of access to deploy or modify workloads within the Kubernetes cluster. Once exploited, the vulnerability enables high impacts to confidentiality, integrity, and availability of the affected systems.

Root Cause

The root cause stems from inadequate validation of the security context constraints for Windows containers in Kubernetes. The platform fails to properly enforce the runAsNonRoot directive when processing Windows workload specifications, allowing containers to escalate their privileges to ContainerAdministrator despite explicit security policies prohibiting such behavior.

This represents a fundamental disconnect between the intended security model and its actual implementation on Windows nodes, where the kubelet or container runtime does not correctly translate or enforce the non-root requirement.

Attack Vector

An attacker with the ability to deploy pods to a Kubernetes cluster with Windows worker nodes can exploit this vulnerability through the following approach:

1. Create a pod specification that sets runAsNonRoot: true in the security context
2. Target the pod for scheduling on a Windows node
3. The container unexpectedly runs with ContainerAdministrator privileges
4. Leverage the elevated privileges to access sensitive resources, modify container configurations, or attack other containers on the same node

The vulnerability requires local access to the cluster (the ability to create or modify pod specifications), making it particularly dangerous in multi-tenant environments where users should be isolated from administrative capabilities.

Detection Methods for CVE-2021-25749

Indicators of Compromise

• Windows containers running with ContainerAdministrator privileges despite having runAsNonRoot: true configured
• Unexpected administrative actions originating from containers that should be running with limited privileges
• Audit logs showing privilege escalation events within Windows container workloads
• Container processes executing with elevated user context on Windows nodes

Detection Strategies

• Implement Kubernetes audit logging to monitor pod creation events with runAsNonRoot configurations on Windows nodes
• Deploy admission controllers to validate that Windows containers are actually running as expected non-root users
• Use runtime security tools to detect privilege level mismatches between pod specifications and actual container execution context
• Monitor container runtime logs on Windows nodes for unexpected user context assignments

Monitoring Recommendations

• Enable verbose Kubernetes API audit logging for all pod creation and modification events
• Implement real-time monitoring of container security contexts on Windows worker nodes
• Configure alerts for any containers running as ContainerAdministrator that have runAsNonRoot specified
• Regularly audit pod specifications across the cluster to verify security context configurations match actual runtime behavior

How to Mitigate CVE-2021-25749

Immediate Actions Required

• Review all Windows workloads currently relying on runAsNonRoot for security enforcement
• Upgrade Kubernetes to a patched version that properly enforces security context constraints on Windows
• Implement additional admission controllers such as Pod Security Admission or OPA Gatekeeper to provide defense-in-depth
• Consider isolating Windows workloads to dedicated node pools with enhanced monitoring until patches are applied

Patch Information

Administrators should upgrade their Kubernetes clusters to patched versions that address this security context bypass vulnerability. Refer to the Kubernetes Security Announcement for specific version information and upgrade guidance.

Ensure all cluster components including the API server, kubelet, and container runtime on Windows nodes are updated to maintain consistent security enforcement.

Workarounds

• Use Pod Security Standards with the "restricted" profile enforced at the namespace level as an additional layer of defense
• Deploy OPA Gatekeeper or Kyverno policies to explicitly validate Windows container user contexts
• Consider using Windows-specific security features like gMSA (Group Managed Service Accounts) to enforce identity constraints
• Limit which users and service accounts can deploy workloads to Windows nodes through RBAC restrictions

# Example: Apply Pod Security Standards to namespace
kubectl label namespace windows-workloads \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted