Skip to content
Fencer Intel
medium 5.5

CVE-2020-8557 json

Kubernetes node disk Denial of Service by writing to container /etc/hosts

published 6y ago modified 4mo ago also GHSA-55qj-gj3x-jq9r , GO-2024-2753 , EUVD-2024-1098

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.

Patch / fix

  • go k8s.io/kubernetes/pkg/kubelet 1.16.13, 1.17.9, 1.18.6
  • go k8s.io/kubernetes 1.16.13, 1.17.9, 1.18.6
  • Kubernetes Kubernetes 1.16.13, 1.17.9, 1.18.6
  • kubernetes Debian 14, Debian 13, Debian 12 1.18.5-1

debian advisories DEBIAN-CVE-2020-8557

  • jenkins openshift 4.3 2.235.5.1600415514-1.el7
  • openshift openshift 4.3 4.3.37-202009120213.p0.git.0.dffefe4.el8
  • openshift-hyperkube openshift 4.3 4.3.37-202009120213.p0.git.0.dffefe4.el8
  • atomic-openshift openshift 3.11 3.11.542-1.git.0.f2fd300.el7
  • atomic-openshift-pod openshift 3.11 3.11.542-1.git.0.f2fd300.el7
  • atomic-openshift-node openshift 3.11 3.11.542-1.git.0.f2fd300.el7
  • atomic-openshift-tests openshift 3.11 3.11.542-1.git.0.f2fd300.el7
  • atomic-openshift-master openshift 3.11 3.11.542-1.git.0.f2fd300.el7

red hat advisories RHSA-2020:3808RHSA-2021:3915RHSA-2020:3579RHSA-2020:3519

  • kubernetes SLE Module for Containers 15 SP1 1.17.4-4.18.1

suse advisories SUSE-RU-2020:2204-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250807T150727-1.1

opensuse advisories openSUSE-SU-2025:15424-1

  • k3s Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.18.6.1-r0

alpine advisories ALPINE-CVE-2020-8557

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2020-8557 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8557 updated cvss 5.5

kubernetes: Node disk DOS by writing to container /etc/hosts

  • Red Hat OpenShift Container Platform 3.11 atomic-openshift 3.11.542-1.git.0.f2fd300.el7, atomic-openshift-pod 3.11.542-1.git.0.f2fd300.el7, atomic-openshift-node 3.11.542-1.git.0.f2fd300.el7, atomic-openshift-tests 3.11.542-1.git.0.f2fd300.el7, atomic-openshift-master 3.11.542-1.git.0.f2fd300.el7, atomic-openshift-clients 3.11.542-1.git.0.f2fd300.el7, +7 more
    fixed: vendor fix RHSA-2021:3915
  • Red Hat OpenShift Container Platform 4.3 openshift4/ose-hyperkube v4.3.37-202009151447.p0, openshift 4.3.37-202009120213.p0.git.0.dffefe4.el8, openshift-hyperkube 4.3.37-202009120213.p0.git.0.dffefe4.el8
    fixed: vendor fix RHSA-2020:3809
  • Red Hat OpenShift Container Platform 4.4 openshift4/ose-hyperkube v4.4.0-202008250319.p0, openshift 4.4.0-202008250319.p0.git.0.d653415.el7, openshift 4.4.0-202008250319.p0.git.0.d653415.el8, openshift-hyperkube 4.4.0-202008250319.p0.git.0.d653415.el7, openshift-hyperkube 4.4.0-202008250319.p0.git.0.d653415.el8
    fixed: vendor fix RHSA-2020:3579
  • Red Hat OpenShift Container Platform 4.5 openshift4/ose-hyperkube v4.5.0-202008130146.p0, openshift 4.5.0-202008130146.p0.git.0.aaf1d57.el7, openshift 4.5.0-202008130146.p0.git.0.aaf1d57.el8, openshift-hyperkube 4.5.0-202008130146.p0.git.0.aaf1d57.el7, openshift-hyperkube 4.5.0-202008130146.p0.git.0.aaf1d57.el8
    fixed: vendor fix RHSA-2020:3519
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-cli v4.6.0-202010311441.p0, openshift4/ose-pod v4.6.0-202010061132.p0, openshift4/ose-pod v4.6.0-202010311441.p0, openshift4/ose-etcd v4.6.0-202010311441.p0, openshift4/ose-tests v4.6.0-202010311441.p0, openshift4/ose-console v4.6.0-202011020726.p0, +174 more
    fixed: vendor fix RHBA-2020:4196
  • Red Hat OpenShift Container Platform 3.11 prometheus 3.11.542-1.git.99aae51.el7, openshift-kuryr 3.11.542-1.git.707a557.el7, openshift-ansible 3.11.542-1.git.0.ee1d12e.el7, openshift-kuryr-cni 3.11.542-1.git.707a557.el7, openshift-kuryr-common 3.11.542-1.git.707a557.el7, prometheus-alertmanager 3.11.542-1.git.13de638.el7, +21 more Red Hat OpenShift Container Platform 4.3 jenkins 2.235.5.1600415514-1.el7, openshift4/ose-sriov-dp-admission-controller v4.3.37-202009151447.p0 Red Hat OpenShift Container Platform 4.5 jenkins 2.235.2.1597312414-1.el7
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go k8s.io/kubernetes/pkg/kubelet
>=1.1.0, <1.16.13
>=1.17.0, <1.17.9
>=1.18.0, <1.18.6
1.16.13
1.17.9
1.18.6
go k8s.io/kubernetes
>=1.1.0, <1.16.13
>=1.17.0, <1.17.9
>=1.18.0, <1.18.6
1.16.13
1.17.9
1.18.6

Affected products

  • Kubernetes Kubernetes

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.