CVE-2020-8557
Fixed in a distro release EPSS <1%CVSS 5.5
The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | 1.16.13 |
| Go | k8s.io/kubernetes | 1.17.9 |
| Go | k8s.io/kubernetes | 1.18.6 |
| Go | k8s.io/kubernetes/pkg/kubelet | 1.16.13 |
| Go | k8s.io/kubernetes/pkg/kubelet | 1.17.9 |
| Go | k8s.io/kubernetes/pkg/kubelet | 1.18.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | kubernetes | 1.18.5-1 |
| Debian:13 | kubernetes | 1.18.5-1 |
| Debian:14 | kubernetes | 1.18.5-1 |
| Red Hat:openshift:3.11 | atomic-openshift | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients-redistributable | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-docker-excluder | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-excluder | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hyperkube | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hypershift | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-master | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-node | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-pod | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-sdn-ovs | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-template-service-broker | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-tests | 0:3.11.542-1.git.0.f2fd300.el7 |
| Red Hat:openshift:4.3 | jenkins | 0:2.235.5.1600415514-1.el7 |
| Red Hat:openshift:4.3 | openshift | 0:4.3.37-202009120213.p0.git.0.dffefe4.el8 |
| Red Hat:openshift:4.3 | openshift-hyperkube | 0:4.3.37-202009120213.p0.git.0.dffefe4.el8 |
| Red Hat:openshift:4.4 | openshift | 0:4.4.0-202008250319.p0.git.0.d653415.el8 |
| Red Hat:openshift:4.4 | openshift | 0:4.4.0-202008250319.p0.git.0.d653415.el7 |
| Red Hat:openshift:4.4 | openshift-hyperkube | 0:4.4.0-202008250319.p0.git.0.d653415.el7 |
| Red Hat:openshift:4.4 | openshift-hyperkube | 0:4.4.0-202008250319.p0.git.0.d653415.el8 |
| Red Hat:openshift:4.5 | jenkins | 0:2.235.2.1597312414-1.el7 |
| Red Hat:openshift:4.5 | openshift | 0:4.5.0-202008130146.p0.git.0.aaf1d57.el7 |
| Red Hat:openshift:4.5 | openshift | 0:4.5.0-202008130146.p0.git.0.aaf1d57.el8 |
| Red Hat:openshift:4.5 | openshift-hyperkube | 0:4.5.0-202008130146.p0.git.0.aaf1d57.el7 |
| Red Hat:openshift:4.5 | openshift-hyperkube | 0:4.5.0-202008130146.p0.git.0.aaf1d57.el8 |
| SUSE:Linux Enterprise Module for Containers 15 SP1 | kubernetes | 1.17.4-4.18.1 |
| Ubuntu:22.04:LTS | kubernetes | no fix |
| Ubuntu:24.04:LTS | kubernetes | no fix |
| Ubuntu:Pro:20.04:LTS | kubernetes | no fix |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 |