CVE-2022-31077
Malicious response from KubeEdge can crash CSI Driver controller server
- State
- Published
- Severity
- 4.0 Medium
- Published
- Jun 27, 2022
- Updated
- Apr 23, 2025
- Reserved
- May 18, 2022
Description
KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.0 Medium | CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H | GitHub_M |
Weaknesses
- CWE-476 NULL Pointer Dereference
Affected Products
| Product | Versions |
|---|---|
kubeedgekubeedge |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.