CVE-2022-31077: linuxfoundation kubeedge

csirt@kutim:~/threat-intel/cve/CVE-2022-31077

CVSS 5.7 · Medium EPSS 0,82%

Kerentanan NULL Pointer Dereference pada linuxfoundation kubeedge. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.

Rincian

Terbit di NVD: 27 Juni 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-476: NULL Pointer Dereference
EPSS (30 hari): 0,82% peluang dieksploitasi; lebih tinggi dari 56,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
linuxfoundation	kubeedge	Semua versi sebelum 1.9.3
linuxfoundation	kubeedge	Versi 1.10.0
linuxfoundation	kubeedge	Versi 1.10.0 beta0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/kubeedge/kubeedge/pull/3899 patch · advisory pihak ketiga
https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe8137664701 patch · advisory pihak ketiga
https://github.com/kubeedge/kubeedge/security/advisories/GHSA-x938-fvfw-7jh5 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.