CVE-2019-9946

Vulnerability

The CNI portmap plugin (versions prior to 0.7.5) used in Kubernetes inserts iptables NAT rules at the front of the chain, taking precedence over the KUBE-SERVICES chain. This misconfiguration allows incoming traffic matching a HostPort to bypass more specific service rules like NodePorts. The issue affects CNI portmap before 0.7.5, which is embedded in Kubernetes releases before 1.11.9, 1.12.7, 1.13.5, and 1.14.0 [1][2].

Exploitation

An attacker can send network traffic to a HostPort assigned to a pod; if there are also service rules (e.g., NodePort) that would normally match more specifically, the portmap rule incorrectly takes precedence due to its position at the front of the chain. This can be exploited by any remote attacker able to reach the node's IP and port, without requiring authentication, as the rule misordering occurs at the iptables level. The issue was identified with kube-proxy in IPVS mode, but other configurations using the CNI portmap plugin may also be vulnerable [2].

Impact

Successful exploitation allows an attacker to bypass intended service network policies, potentially reaching a pod's HostPort instead of a more restricted service endpoint. This can lead to unauthorized access to services running on the pod, information disclosure, or further compromise depending on the pod's functionality. The attacker gains network access at the same privilege level as the host's networking, potentially intercepting or redirecting traffic meant for NodePort services [2].

Mitigation

Upgrade the CNI portmap plugin to version 0.7.5 or later, which appends rather than prepends iptables rules, ensuring KUBE-SERVICES rules are evaluated first [2]. For Kubernetes, upgrade to versions 1.11.9, 1.12.7, 1.13.5, or 1.14.0 [2]. Red Hat Enterprise Linux 7 Extras provides an updated containernetworking-plugins package to v0.7.5 [1]. No workaround other than upgrading is documented, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.