Описание
Kyverno Denial of Service via Context Variable Amplification in Policy Engine
Summary
Unbounded memory consumption in Kyverno's policy engine allows users with policy creation privileges to cause Denial of Serviceby crafting policies that exponentially amplify string data through context variables.
Details
For example, the random() JMESPath function in pkg/engine/jmespath/functions.go generates random strings. Combined with the join() function, an attacker can create exponential string amplification through context variable chaining:
The PoC attack uses exponential doubling:
l0=random('[a-zA-Z0-9]{1000}')→ 1KBl1=join('', [l0, l0])→ 2KBl2=join('', [l1, l1])→ 4KB- ... continues to
l18→ 256MB
The context evaluation has no cumulative size limit, allowing unbounded memory allocation.
PoC
Tested on Kyverno v1.16.1 on k8s v1.34.0 (kind).
- Create namespace:
- Observe pod statuses from
kyvernonamespace on another terminal:
- Apply malicious policy:
As soon as you apply this, you'll see the reports controller gets OOM killed and the container enters a crash loop.
- Trigger policy evaluation on the admission controller:
Response:
The Kyverno admission controller has allocated ~256MB of memory per policy evaluation. The default memory limit from the Helm chart is 256 MB, and the process crashes.
- Check pod status from the
kyvernonamespace:
Outputs:
While the reports controller is in a crash loop, the admission controller crashes only on trigger. You can re-run the same kubectl create configmap command from above and reproduce the crash.
Impact
Denial of Service with cluster-wide security impact. Users with Policy or ClusterPolicy creation privileges can exhaust memory in the Kyverno admission controller and the reports controller, causing:
- Pod OOMKill and service disruption
- No logs on why the crash occurred (admission controller, reports controller)
- Cluster-wide policy enforcement disabled and security policies stop being evaluated
- If
failurePolicy: Ignoreis configured, workloads bypass all validation during outage - Applications depending on Kyverno mutations may deploy with incorrect configurations
Any Kyverno deployment where non-admin users can create policies (e.g., namespace-scoped Policy resources) is affected.
Mitigation
Add a context size limit to prevent unbounded memory allocation during policy evaluation.
Пакеты
github.com/kyverno/kyverno
< 1.15.3
1.15.3
github.com/kyverno/kyverno
>= 1.16.0-rc.1, < 1.16.3
1.16.3
Связанные уязвимости
Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of service by crafting policies that exponentially amplify string data through context variables. Versions 1.16.3 and 1.15.3 contain a patch for the vulnerability.