CVE-2020-8557
Kubernetes node disk Denial of Service by writing to container /etc/hosts
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Kubernetes node disk Denial of Service by writing to container /etc/hosts
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
CVE-2020-8557- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2024-1098
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
EUVD-2024-1098- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-55qj-gj3x-jq9r
Denial of service in Kubernetes
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
GHSA-55qj-gj3x-jq9r- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
CVE-2020-8557- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-8557
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
ALPINE-CVE-2020-8557- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
CVE-2020-8557- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2020-8557
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
DEBIAN-CVE-2020-8557- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-55qj-gj3x-jq9r
Denial of service in Kubernetes
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
GHSA-55qj-gj3x-jq9r- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVRHSA-2020:3519
Red Hat Security Advisory: OpenShift Container Platform 4.5.7 jenkins and openshift packages security update
- Record
RHSA-2020:3519- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3579
Red Hat Security Advisory: OpenShift Container Platform 4.4.19 openshift security update
- Record
RHSA-2020:3579- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3808
Red Hat Security Advisory: OpenShift Container Platform 4.3.38 jenkins and openshift security update
- Record
RHSA-2020:3808- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:3915
Red Hat Security Advisory: OpenShift Container Platform 3.11.542 security update
- Record
RHSA-2021:3915- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8557
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
- Record
UBUNTU-CVE-2020-8557- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGO-2024-2753 No score
Denial of service in Kubernetes in k8s.io/kubernetes
Denial of service in Kubernetes in k8s.io/kubernetes
- Record
GO-2024-2753- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15424-1 No score
govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15424-1- Updated
- 2026-11-02
OSVSUSE-RU-2020:2204-1 No score
Bugfixes on cilium, gangway and skuba and security fix for Kubernetes (cve-2020-8557)
= Required Actions
== Kubernetes (Security fix)
This fix will be applied to the kubelet daemon running on the nodes by skuba-update.
See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_base_os_updates for more details.
Make sure you look at the Release Notes https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2_2 for any known bug.
== Cilium Bugfix
Cilium will be updated by skuba addon upgrade. No action is required from your side.
For more info see https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_generating_an_overview_of_available_addon_updates
== Gangway bugfix
Gangway will be updated by skuba addon upgrade. No action is required from your side.
For more info see https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_generating_an_overview_of_available_addon_updates
== Skuba
In order to update skuba, you need to update the admin workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.1/html/caasp-admin/_cluster_updates.html#_update_management_workstation
- Record
SUSE-RU-2020:2204-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
k8s.io/kubernetes/pkg/kubeletGo |
1.1.0 up to 1.16.13 | 1.16.13 |
k8s.io/kubernetes/pkg/kubeletGo |
1.17.0 up to 1.17.9 | 1.17.9 |
k8s.io/kubernetes/pkg/kubeletGo |
1.18.0 up to 1.18.6 | 1.18.6 |
k3sAlpine:v3.13 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.14 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.15 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.16 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.17 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.18 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.19 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
k3sAlpine:v3.20 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.21 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.22 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.23 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
k3sAlpine:v3.24 |
before 1.18.6.1-r0 | 1.18.6.1-r0 |
kubernetesDebian:12 |
before 1.18.5-1 | 1.18.5-1 |
kubernetesDebian:13 |
before 1.18.5-1 | 1.18.5-1 |
kubernetesDebian:14 |
before 1.18.5-1 | 1.18.5-1 |
k8s.io/kubernetesGo |
1.1.0 up to 1.16.13, 1.17.0 up to 1.17.9, 1.18.0 up to 1.18.6 | 1.16.131.17.91.18.6 |
jenkinsRed Hat:openshift:4.5::el7 |
before 0:2.235.2.1597312414-1.el7 | 0:2.235.2.1597312414-1.el7 |
openshiftRed Hat:openshift:4.5::el7 |
before 0:4.5.0-202008130146.p0.git.0.aaf1d57.el7 | 0:4.5.0-202008130146.p0.git.0.aaf1d57.el7 |
openshift-hyperkubeRed Hat:openshift:4.5::el7 |
before 0:4.5.0-202008130146.p0.git.0.aaf1d57.el7 | 0:4.5.0-202008130146.p0.git.0.aaf1d57.el7 |
openshiftRed Hat:openshift:4.5::el8 |
before 0:4.5.0-202008130146.p0.git.0.aaf1d57.el8 | 0:4.5.0-202008130146.p0.git.0.aaf1d57.el8 |
openshift-hyperkubeRed Hat:openshift:4.5::el8 |
before 0:4.5.0-202008130146.p0.git.0.aaf1d57.el8 | 0:4.5.0-202008130146.p0.git.0.aaf1d57.el8 |
openshiftRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202008250319.p0.git.0.d653415.el7 | 0:4.4.0-202008250319.p0.git.0.d653415.el7 |
openshift-hyperkubeRed Hat:openshift:4.4::el7 |
before 0:4.4.0-202008250319.p0.git.0.d653415.el7 | 0:4.4.0-202008250319.p0.git.0.d653415.el7 |
openshiftRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202008250319.p0.git.0.d653415.el8 | 0:4.4.0-202008250319.p0.git.0.d653415.el8 |
openshift-hyperkubeRed Hat:openshift:4.4::el8 |
before 0:4.4.0-202008250319.p0.git.0.d653415.el8 | 0:4.4.0-202008250319.p0.git.0.d653415.el8 |
jenkinsRed Hat:openshift:4.3::el7 |
before 0:2.235.5.1600415514-1.el7 | 0:2.235.5.1600415514-1.el7 |
openshiftRed Hat:openshift:4.3::el8 |
before 0:4.3.37-202009120213.p0.git.0.dffefe4.el8 | 0:4.3.37-202009120213.p0.git.0.dffefe4.el8 |
openshift-hyperkubeRed Hat:openshift:4.3::el8 |
before 0:4.3.37-202009120213.p0.git.0.dffefe4.el8 | 0:4.3.37-202009120213.p0.git.0.dffefe4.el8 |
atomic-openshiftRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-clientsRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-excluderRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-hyperkubeRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-hypershiftRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-masterRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-nodeRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-podRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-template-service-brokerRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
atomic-openshift-testsRed Hat:openshift:3.11::el7 |
before 0:3.11.542-1.git.0.f2fd300.el7 | 0:3.11.542-1.git.0.f2fd300.el7 |
kubernetesSUSE:Linux Enterprise Module for Containers 15 SP1 |
before 1.17.4-4.18.1 | 1.17.4-4.18.1 |
govulncheck-vulndbopenSUSE:Tumbleweed |
before 0.0.20250807T150727-1.1 | 0.0.20250807T150727-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8557 is a medium vulnerability (CVSS 5.5) in Kubernetes, published July 23, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in k8s.io/kubernetes/pkg/kubelet 1.16.13.
References
github.com/kubernetes/kubernetes/issues/93032
groups.google.com/g/kubernetes-security-announce/c/cB_JUsYEKyY/m/vVSO61AhBwAJ
security.netapp.com/advisory/ntap-20200821-0002
nvd.nist.gov/vuln/detail/CVE-2020-8557
Show 112 moreShow less
pkg.go.dev/vuln/GO-2024-2753
security.alpinelinux.org/vuln/CVE-2020-8557
security-tracker.debian.org/tracker/CVE-2020-8557
access.redhat.com/errata/RHSA-2020:3519
bugzilla.redhat.com/show_bug.cgi?id=1835977
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3519.json
cve.org/CVERecord?id=CVE-2020-2220
bugs.eclipse.org/bugs/show_bug.cgi?id=564984
jenkins.io/security/advisory/2020-08-17
jenkins.io/security/advisory/2020-08-12
suse.com/support/update/announcement/-2020-2204/suse-ru-20202204-1
bugzilla.suse.com/1146991
ubuntu.com/security/CVE-2020-8557