CVE-2024-0793: Kube-Controller-Manager DoS Vulnerability

CVE-2024-0793 Overview

A denial of service vulnerability was discovered in Kubernetes kube-controller-manager (KCM). This flaw occurs when applying an initial Horizontal Pod Autoscaler (HPA) configuration YAML that lacks a .spec.behavior.scaleUp block, causing KCM pods to enter a restart churn cycle, effectively resulting in denial of service conditions for the Kubernetes control plane.

Critical Impact
This vulnerability can cause complete disruption of Kubernetes cluster operations by forcing the kube-controller-manager into continuous restart loops, impacting cluster scaling, resource management, and overall availability.

Affected Products

Kubernetes kube-controller-manager
Red Hat OpenShift Container Platform
Kubernetes distributions utilizing the affected kube-controller-manager component

Discovery Timeline

November 17, 2024 - CVE-2024-0793 published to NVD
November 18, 2024 - Last updated in NVD database

Technical Details for CVE-2024-0793

Vulnerability Analysis

This vulnerability is classified as an Improper Input Validation flaw (CWE-20) within the Kubernetes kube-controller-manager component. The issue manifests when processing Horizontal Pod Autoscaler (HPA) configuration files that do not include the .spec.behavior.scaleUp block.

When such a malformed HPA configuration is initially applied to a Kubernetes cluster, the kube-controller-manager fails to properly handle the missing configuration block. This causes the KCM pods to crash and enter a continuous restart cycle, effectively creating a denial of service condition. The vulnerability is particularly concerning because it can be triggered through legitimate cluster operations by any user with permissions to create or modify HPA resources.

The attack can be executed remotely over the network and requires low privileges to exploit. While it does not impact data confidentiality or integrity, it severely affects service availability. The scope is changed, meaning the vulnerability can impact resources beyond its security scope, affecting the entire Kubernetes control plane functionality.

Root Cause

The root cause of this vulnerability lies in improper input validation within the kube-controller-manager's HPA processing logic. Specifically, the controller does not properly handle cases where the .spec.behavior.scaleUp configuration block is absent from an HPA manifest. The missing null check or default value handling causes the controller to encounter an unhandled exception state, triggering pod crashes.

Attack Vector

The attack vector is network-based, requiring an authenticated user with permissions to create or modify HPA resources in the Kubernetes cluster. An attacker could exploit this vulnerability by:

Crafting a malicious HPA configuration YAML file without the .spec.behavior.scaleUp block
Applying this configuration to the target Kubernetes cluster using kubectl apply or the Kubernetes API
The kube-controller-manager processes the invalid configuration and crashes
Kubernetes attempts to restart the KCM pod, but it crashes again upon processing the same HPA resource
This creates a restart loop that disrupts control plane operations

The vulnerability can be triggered by submitting an HPA manifest similar to the following structure that omits the scaleUp behavior specification while including other behavior settings. For detailed technical information, refer to the GitHub OpenShift PR #1876.

Detection Methods for CVE-2024-0793

Indicators of Compromise

Unusual restart patterns in kube-controller-manager pods with CrashLoopBackOff status
HPA resources in the cluster that lack .spec.behavior.scaleUp configuration blocks
Control plane instability or degraded cluster responsiveness
Error logs in kube-controller-manager indicating nil pointer or validation failures related to HPA processing

Detection Strategies

Monitor kube-controller-manager pod health and restart counts using Kubernetes metrics
Implement admission controllers or OPA policies to validate HPA configurations before application
Review cluster audit logs for HPA creation events, particularly those with incomplete behavior specifications
Set up alerting for control plane component availability degradation

Monitoring Recommendations

Configure Prometheus alerts for kube-controller-manager restart thresholds exceeding normal baselines
Enable Kubernetes audit logging to capture all HPA create and update operations
Deploy cluster health monitoring to detect control plane service disruptions
Implement SentinelOne Kubernetes Workload Protection for real-time container and pod behavior analysis

How to Mitigate CVE-2024-0793

Immediate Actions Required

Review all existing HPA configurations in the cluster for missing .spec.behavior.scaleUp blocks
Implement admission webhook policies to reject HPA manifests without complete behavior specifications
Update affected Kubernetes or OpenShift installations to patched versions
Monitor kube-controller-manager pods for stability issues

Patch Information

Red Hat has released security advisories addressing this vulnerability. Organizations running affected versions should apply the following patches:

For OpenShift users, the fix is available through GitHub OpenShift PR #1876. Additional details about the vulnerability and remediation are available in the Red Hat CVE Details for CVE-2024-0793.

Workarounds

Ensure all HPA configurations include complete .spec.behavior blocks with both scaleUp and scaleDown specifications
Implement Kubernetes ValidatingAdmissionWebhook to block incomplete HPA configurations
Use GitOps practices to review and validate HPA manifests before cluster deployment
Restrict HPA creation permissions using RBAC to trusted users and service accounts only

bash

# Example: Validating HPA configurations before applying
# Check for missing scaleUp behavior in HPA manifests
kubectl get hpa -A -o json | jq '.items[] | select(.spec.behavior != null and .spec.behavior.scaleUp == null) | {namespace: .metadata.namespace, name: .metadata.name}'

# Apply RBAC restrictions for HPA management
kubectl create clusterrole hpa-restricted --verb=create,update,patch --resource=horizontalpodautoscalers --dry-run=client -o yaml