{"id":"CVE-2021-25749","aliases":["EUVD-2021-12632","GHSA-vv2r-w4hf-7mhr","SUSE-SU-2023:2292-1","openSUSE-SU-2024:12780-1"],"status":"published","title":"runAsNonRoot logic bypass for Windows containers","description":"Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00211,"percentile":0.11401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2023-05-24T00:00:00Z","modified":"2026-10-24T10:30:20Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"kubernetes1.23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.17-150300.7.6.1"}]}],"bundled":3}],"products":[{"vendor":"kubernetes","product":"kubernetes"}],"references":[{"url":"https://groups.google.com/g/kubernetes-security-announce/c/qqTZgulISzA","tags":["x_transferred","Mailing List","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25749"},{"url":"https://github.com/advisories/GHSA-vv2r-w4hf-7mhr"},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232292-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3294","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-25749","title":"runAsNonRoot logic bypass for Windows containers","description":"Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.","status":"published","published":"2023-05-24T00:00:00Z","modified":"2025-01-16T21:21:12.621Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-12632","description":"Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.","status":"published","published":"2023-05-24T00:00:00Z","modified":"2025-01-16T21:21:12Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:18.077485Z"}],"ghsa":[{"id":"GHSA-vv2r-w4hf-7mhr","title":"Windows workloads can run as ContainerAdministrator even when those workloads set the...","description":"Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.","status":"published","published":"2023-05-24T18:30:26Z","modified":"2024-04-04T04:19:43Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:56:22.887174Z"}],"nvd":[{"id":"CVE-2021-25749","description":"Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.","status":"published","published":"2023-05-24T17:15:09.413Z","modified":"2026-06-17T03:42:23.86Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:07.764332Z"}],"osv":[{"id":"CVE-2021-25749","description":"Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true.","status":"published","published":"2023-05-24T17:15:09.413Z","modified":"2026-10-24T10:30:20.435883085Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"openSUSE-SU-2024:12780-1","title":"kubernetes1.23-apiserver-1.23.17-1.1 on GA media","description":"These are all security issues fixed in the kubernetes1.23-apiserver-1.23.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:03:25.943867Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:2292-1","title":"Security update for kubernetes1.23","description":"This update for kubernetes1.23 fixes the following issues:\n\n- add kubernetes1.18-client-common as conflicts with kubernetes-client-bash-completion \n\n- Split individual completions into separate packages\n\nUpdate to version 1.23.17:\n\n  * releng: Update images, dependencies and version to Go 1.19.6\n  * Update golang.org/x/net to v0.7.0\n  * Pin golang.org/x/net to v0.4.0\n  * add scale test for probes\n  * use custom dialer for http probes\n  * use custom dialer for tcp probes\n  * add custom dialer optimized for probes\n  * egress_selector: prevent goroutines leak on connect() step.\n  * tls.Dial() validates hostname, no need to do that manually\n  * Fix issue that Audit Server could not correctly encode DeleteOption\n  * Do not include scheduler name in the preemption event message\n  * Do not leak cross namespace pod metadata in preemption events\n  * pkg/controller/job: re-honor exponential backoff\n  * releng: Update images, dependencies and version to Go 1.19.5\n  * Bump Konnectivity to v0.0.35\n  * Improve vendor verification works for each staging repo\n  * Update to go1.19\n  * Adjust for os/exec changes in 1.19\n  * Update golangci-lint to 1.46.2 and fix errors\n  * Match go1.17 defaults for SHA-1 and GC\n  * update golangci-lint to 1.45.0\n  * kubelet: make the image pull time more accurate in event\n  * change k8s.gcr.io/pause to registry.k8s.io/pause\n  * use etcd 3.5.6-0 after promotion\n  * changelog: CVE-2022-3294 and CVE-2022-3162 were fixed in v1.23.14\n  * Add CVE-2021-25749 to CHANGELOG-1.23.md\n  * Add CVE-2022-3294 to CHANGELOG-1.23.md\n  * kubeadm: use registry.k8s.io instead of k8s.gcr.io\n  * etcd: Updated to v3.5.5\n  * Bump konnectivity network proxy to v0.0.33. Includes a couple bug fixes for better handling of dial failures. [Agent \u0026 Server](https://github.com/kubernetes-sigs/apiserver-network-proxy/commits/v0.0.33) include numerous other fixes.\n  * kubeadm: allow RSA and ECDSA format keys in preflight check\n  * Fixes kubelet log compression on Windows\n  * Reduce default gzip compression level from 4 to 1 in apiserver\n  * exec auth: support TLS config caching\n  * Marshal MicroTime to json and proto at the same precision\n  * Windows: ensure runAsNonRoot does case-insensitive comparison on user name\n  * update structured-merge-diff to 4.2.3\n  * Add rate limiting when calling STS assume role API\n  * Fixing issue in generatePodSandboxWindowsConfig for hostProcess containers by where pod sandbox won't have HostProcess bit set if pod does not have a security context but containers specify HostProcess.\n","status":"published","published":"2023-05-25T07:21:44Z","modified":"2025-05-02T04:31:15.424968Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}