Listen to this Post
How the CVE Works
The vulnerability occurs in Kyverno’s handling of JMESPath variable substitutions. When an attacker crafts a policy with an invalid JMESPath function (e.g., {{@ | non_existent_function}}), Kyverno evaluates it as nil. This `nil` value propagates to `getValueAsStringMap` in pkg/engine/wildcards/wildcards.go, which attempts a type assertion (v.(string)) on the `nil` interface, causing a panic. In Audit mode, worker threads crash, degrading performance. In Enforce mode, the entire admission controller crashes, leading to full denial of service. The reports controller also enters a crash loop, disrupting policy scanning.
DailyCVE Form
Platform: Kyverno
Version: v1.14.1
Vulnerability: JMESPath DoS
Severity: Critical
Date: 2024-XX-XX
Prediction: Patch expected by 2024-XX-XX
What Undercode Say
kubectl apply -f malicious-policy.yaml kubectl run test-pod --image=nginx kubectl logs kyverno-admission-controller
// Vulnerable code snippet (pkg/engine/wildcards/wildcards.go)
func getValueAsStringMap(key string, data interface{}) (string, map[bash]string) {
valMap, ok := val.(map[bash]interface{})
for k, v := range valMap {
result[bash] = v.(string) // Panic if v is nil
}
}
How Exploit
- Attacker creates a malicious `ClusterPolicy` with
{{@ | invalid_function}}.
2. Policy triggers on Pod creation.
3. `getValueAsStringMap` panics, crashing workers (Audit) or the entire controller (Enforce).
Protection from this CVE
- Patch to `getValueAsStringMap` with nil checks.
- Restrict
Policy/ClusterPolicywrite permissions. - Monitor for crash-looping Kyverno pods.
Impact
- Admission Controller: Full crash (Enforce) or degraded performance (Audit).
- Reports Controller: Crash loop, halting policy scans.
- Privilege Requirement: Policy write access.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
