CVE-2025-0426: Kubernetes Kubelet DoS Vulnerability

CVE-2025-0426 Overview

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk. This vulnerability allows attackers with local access to exploit the kubelet's checkpoint functionality to exhaust disk resources on Kubernetes nodes.

Critical Impact

Attackers can cause Node Denial of Service by exhausting disk space through repeated container checkpoint requests to the unauthenticated kubelet read-only endpoint, potentially disrupting containerized workloads across the cluster.

Affected Products

• Kubernetes (kubelet component)
• Kubernetes clusters with read-only kubelet endpoint enabled
• Container orchestration environments using affected Kubernetes versions

Discovery Timeline

• February 13, 2025 - CVE-2025-0426 published to NVD
• February 13, 2025 - Last updated in NVD database

Technical Details for CVE-2025-0426

Vulnerability Analysis

This vulnerability is classified as a Resource Exhaustion issue (CWE-400: Uncontrolled Resource Consumption). The kubelet component in Kubernetes exposes a read-only HTTP endpoint that does not require authentication by default. This endpoint includes functionality for container checkpointing, which creates disk-based snapshots of running containers.

The core issue stems from the lack of rate limiting or resource quotas on the checkpoint request functionality. An attacker with local access to a Kubernetes node can issue a high volume of container checkpoint requests, causing the kubelet to generate numerous checkpoint files. These files accumulate on the node's filesystem without proper cleanup mechanisms being triggered during the attack, ultimately filling the available disk space.

When disk space is exhausted, the affected node can no longer perform critical operations including container scheduling, log writing, and system maintenance tasks. This effectively renders the node unavailable, impacting all workloads scheduled on that node.

Root Cause

The root cause is improper resource management in the kubelet's read-only HTTP endpoint. Specifically, the checkpoint request handler lacks adequate controls to prevent abuse:

1. No Authentication Required: The read-only endpoint operates without authentication by default, allowing any local process to make requests
2. Missing Rate Limiting: There are no restrictions on the frequency or volume of checkpoint requests
3. Insufficient Disk Quota Enforcement: The checkpoint functionality does not enforce disk usage limits before creating new checkpoint files
4. Lack of Automatic Cleanup: Old or excessive checkpoint files are not automatically purged under resource pressure

Attack Vector

The attack requires local access to the Kubernetes node where the kubelet is running. An attacker must be able to reach the kubelet's read-only HTTP endpoint, typically exposed on port 10255. The attack is executed by sending a flood of checkpoint requests to the endpoint, causing rapid disk consumption.

The attacker does not need any special privileges or authentication tokens to exploit this vulnerability. Simply having network access to the kubelet's read-only port from within the node or a co-located container is sufficient to trigger the denial of service condition.

The attack progresses by repeatedly requesting container checkpoints through the unauthenticated endpoint. Each checkpoint consumes disk space, and without rate limiting, an attacker can quickly exhaust available storage. Once disk space is depleted, the node becomes unresponsive to legitimate workload operations.

Detection Methods for CVE-2025-0426

Indicators of Compromise

• Unusual spike in disk usage on Kubernetes nodes, particularly in kubelet checkpoint directories
• High volume of HTTP requests to the kubelet read-only endpoint on port 10255
• Presence of numerous checkpoint files with timestamps clustered in a short time period
• Node status changes to NotReady or DiskPressure conditions in cluster monitoring

Detection Strategies

• Monitor kubelet read-only endpoint access logs for abnormal request patterns targeting checkpoint functionality
• Implement disk usage alerts that trigger when node storage exceeds defined thresholds
• Deploy network monitoring to detect unusual traffic volumes to kubelet ports from within the cluster
• Use Kubernetes event monitoring to track DiskPressure node conditions

Monitoring Recommendations

• Configure alerting on rapid disk consumption rates on Kubernetes nodes
• Set up network flow analysis for kubelet endpoint traffic patterns
• Implement log aggregation for kubelet access logs to identify request anomalies
• Enable Kubernetes audit logging to track checkpoint-related API activities

How to Mitigate CVE-2025-0426

Immediate Actions Required

• Disable the kubelet read-only port (--read-only-port=0) if not required for monitoring purposes
• Implement network policies to restrict access to kubelet endpoints from untrusted pods
• Configure disk usage quotas and monitoring on Kubernetes nodes
• Review and restrict which containers have network access to node-level services

Patch Information

Organizations should monitor the Kubernetes Security Announcement for official patch releases. The GitHub Issue Discussion provides additional technical context and tracks the resolution progress. The OpenWall OSS Security Update contains supplementary security information.

Workarounds

• Disable the read-only kubelet port by setting --read-only-port=0 in kubelet configuration
• Use network policies to block access to port 10255 from non-essential services
• Implement pod security policies that prevent containers from accessing host network
• Configure disk usage limits and alerts to detect potential abuse early

# Configuration example
# Disable kubelet read-only port in kubelet configuration
# Add to kubelet configuration file or command line arguments:
--read-only-port=0

# Or in kubelet config file (kubelet-config.yaml):
# readOnlyPort: 0

# Apply network policy to restrict kubelet endpoint access
# kubectl apply -f kubelet-network-policy.yaml