medium
advisory
AWS EKS: Potential Privilege Escalation via HostNetwork Pod Creation
Kubernetes pods attached to the host network can access services running on the host's localhost, potentially allowing network traffic snooping or the bypassing of network policies.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 5 public sources
- Freshness
- Revision 1Oct 21, 14:00 UTC
- Source quality
- B2Roughly even chance
HostNetwork allows a pod to use the node network namespace. This access can be exploited to snoop on network activity of other pods on the same node or bypass restrictive network policies applied to its given namespace. The detection rule identifies pod creation or modification events with HostNetwork enabled, excluding known benign images.
Triage and Analysis
- Review Kubernetes audit logs to identify the user or service account associated with the pod creation or modification.
- Examine the pod configuration, specifically container images, to determine if unauthorized images are being used.
- Assess the necessity of HostNetwork for the pod and determine if it can be reconfigured to operate without this setting.
- Check Kubernetes RBAC settings to ensure users/service accounts are not overly privileged.
False Positives
- Administrative or developer pods running with host namespaces for debugging purposes.
- Monitoring, logging, or infrastructure services (e.g., CNI plugins, ingress controllers) that require HostNetwork for legitimate operations.