This affects all versions of Kubernetes between 1.5.0 and 1.7.6.
Relevant posts:
- https://groups.google.com/forum/#!topic/kubernetes-dev/QWIzh...
- https://coreos.com/blog/dns-vulnerability-patched-in-kuberne...
Relevant posts:
- https://groups.google.com/forum/#!topic/kubernetes-dev/QWIzh...
- https://coreos.com/blog/dns-vulnerability-patched-in-kuberne...
Then it lets you escape to the dnsmasq container. Which does have a shell, but I'm struggling to think how this gets you more capability than "able to run arbitrary code inside the cluster".
Most likely I missed something. Help me spot it.
You would need to middle man traffic between dnsmasq and upstream DNS or have some control over DNS records and be able to force dnsmasq to do lookups. As you point out the escalation is also far more limited. Ok, so you have a shell in the dnsmasq container. Now what?
> All GKE clusters have already been patched, so no action is necessary for GKE users. Users will see a "-gke.1" version for the MASTER_VERSION of their GKE clusters, which contains the patch.