Unchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplane

Vulnerability

Overview

CVE-2023-27484 is a resource exhaustion vulnerability in crossplane-runtime, a set of Go libraries used to build Kubernetes controllers in Crossplane and its related stacks. The root cause lies in how Compositions handle array patch indexes: When a Composition specifies a patch that inserts an element into a target slice at an arbitrary index, the code grows the slice to accommodate that index. An attacker who can create or update a Composition can set this index to an arbitrarily high value (up to the uint32 maximum of 4294967295). Even though the index is capped at parse time, the resulting slice growth can consume excessive memory, leading to an out-of-memory (OOM) kill of the Crossplane pod. [1][3]

Attack

Surface and Exploitation

Exploitation requires a highly privileged attacker who already has the ability to create or update Composition resources in the Crossplane cluster. Such a user can craft a Composition with a patch ToFieldPath specifying an extremely high array index. Once this Composition is selected for a Composite Resource, the patch evaluation triggers unconditional slice growth, causing memory allocation proportional to the index value. The vulnerability does not require any additional authentication beyond the existing write permissions on Compositions. [1][3]

Impact

A successful attack causes the Crossplane pod to be OOM-killed, resulting in a denial of service (DoS) of the Crossplane control plane. This can disrupt the management of cloud resources orchestrated by Crossplane. No data confidentiality or integrity compromise is described, but availability is directly affected. [1]

Mitigation

Crossplane has released patched versions 1.11.2, 1.10.3, and 1.9.2 that address the issue by properly capping the patch index. Users are advised to upgrade to these or later versions. For users who cannot immediately upgrade, a workaround is to restrict write privileges on Composition resources to only admin users, thereby limiting the attack surface. [1][3]