search

wiz-sec / open-cvdb

An open project to list all publicly known cloud vulnerabilities and CSP security issues
https://cloudvulndb.org
Creative Commons Attribution 4.0 International
303 stars 61 forks source link

[Contribution] Add remaining GCP Bulletins #245

Closed ramimac closed 10 months ago

ramimac commented 11 months ago

Summary (give a brief description of the issue)

GCP-2023-007

A vulnerability was recently discovered in Cloud SQL for SQL Server that allowed customer administrator accounts to create triggers in the tempdb database and use those to gain sysadmin privileges in the instance. The sysadmin privileges would give the attacker access to system databases and partial access to the machine running that SQL Server instance.

Google Cloud resolved the issue by patching the security vulnerability by March 1, 2023. Google Cloud didn't find any compromised customer instances.

GCP-2022-011

There is a misconfiguration with Simultaneous Multi-Threading (SMT), also known as Hyper-threading, on GKE Sandbox images. The misconfiguration leaves nodes potentially exposed to side channel attacks such as Microarchitectural Data Sampling (MDS) (for more context, see GKE Sandbox documentation). We do not recommend using the following affected versions:

GCP-2022-009

Some unexpected paths to access the node VM on GKE Autopilot clusters could have been used to escalate privileges in the cluster. These issues have been fixed and no further action is required. The fixes address issues reported through our Vulnerability Reward Program.

GCP-2021-019

There is a known issue where updating a BackendConfig resource using the v1beta1 API removes an active Google Cloud Armor security policy from its service.

GCP-2021-022

A vulnerability has been discovered in the Anthos Identity Service (AIS) LDAP module of Anthos clusters on VMware versions 1.8 and 1.8.1 where a seed key used in generating keys is predictable. With this vulnerability, an authenticated user could add arbitrary claims and escalate privileges indefinitely.

References (provide links to blogposts, etc.)

  1. GCP-2023-013
  2. GCP-2023-007
  3. GCP-2022-011
  4. GCP-2022-009
  5. GCP-2021-019
  6. GCP-2021-022
ramimac commented 11 months ago

Note: inspired by https://github.com/wiz-sec/open-cvdb/issues/244

  1. Searched https://cloud.google.com/support/bulletins for all bulletins that weren't due to a CVE
  2. Removed the one that was previously added to open-cvdb
korniko98 commented 10 months ago

Removed GCP-2022-009 since it's a duplicate of https://www.cloudvulndb.org/gke-autopilot-allowlist, and added the GCP security bulletin references to the existing entry.