CVE-2023-32187

Vulnerability

Overview

CVE-2023-32187 is a resource exhaustion vulnerability in SUSE's lightweight Kubernetes distribution, K3s. The root cause is a lack of limits or throttling when handling TLS Subject Alternative Name (SAN) entries. An attacker with network access to the K3s server's apiserver/supervisor port (TCP 6443) can perform a TLS handshake and force the server to add entries to the certificate's SAN list, a stuffing attack [3]. This continues until the certificate exceeds the maximum size allowed by TLS client implementations, such as OpenSSL, which raises an excessive message size error [3].

Exploitation

No authentication is required to exploit this vulnerability; only the ability to establish a TLS handshake with the targeted port (TCP 6443) [1][3]. This makes the attack surface broad, as any network-accessible K3s server is potentially vulnerable. The attacker repeatedly initiates TLS connections, each time padding the SAN list, gradually bloating the certificate. The process does not require any special privileges or prior access to the cluster [3].

Impact

Successful exploitation leads to a denial of service (DoS) condition. While the affected K3s server continues to operate, clients—including administrative tools like kubectl and new server or agent nodes—fail to establish new TLS connections [3]. This disrupts cluster management and scaling, effectively blocking legitimate administrative access and node joins until the issue is resolved.

Mitigation

SUSE has released fixed versions for all affected release lines: v1.24.17+k3s1, v1.25.13+k3s1, v1.26.8+k3s1, v1.27.5+k3s1, and v1.28.1+k3s1 [2][3]. Users on K3s 1.27 or earlier must also add the configuration parameter tls-san-security: true to enable enhanced security for the supervisor's TLS SAN list; this option defaults to true starting with K3s 1.28 [3]. A mitigation is available for those who cannot upgrade immediately: freezing the certificate via kubectl annotate secret -n kube-system k3s-serving listener.cattle.io/static=true, though this prevents automatic renewal and addition of new SAN entries [3].