What’s Vulnerable › Vulnerabilities

CVE-2022-31077: Malicious response from KubeEdge can crash CSI Driver controller server

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-27 · updated 2026-06-17
• Weakness: CWE-476

Description

KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.

Affected products

• kubeedge: before 1.9.3; 1.10.0, 1.10.0-beta0 — fixed in 1.9.3

How to fix

Upgrade to a fixed version: kubeedge 1.9.3. Check the vendor advisory for mitigations.

References

• https://github.com/kubeedge/kubeedge/pull/3899
• https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe8137664701
• https://github.com/kubeedge/kubeedge/security/advisories/GHSA-x938-fvfw-7jh5
• https://github.com/kubeedge/kubeedge/pull/3899
• https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe8137664701
• https://github.com/kubeedge/kubeedge/security/advisories/GHSA-x938-fvfw-7jh5

Get alerted when CVE-2022-31077 or the next vulnerability affects your stack