AIKIDO-2025-10181

sigs.k8s.io/azuredisk-csi-driver is vulnerable to Uncontrolled Resource Consumption

Uncontrolled Resource ConsumptionCVE-2025-0426 Published Mar 26, 2025

Medium Risk

This Affects:

sigs.k8s.io/azuredisk-csi-driver

0.3.0 - 1.29.13

Fixed in 1.29.14

1.30.0 - 1.30.9

Fixed in 1.30.10

1.31.0 - 1.31.5

Fixed in 1.31.6

1.32.0 - 1.32.1

Fixed in 1.32.2

Are you affected? Scan for Free

TL;DR

Affected versions of this package are vulnerable to uncontrolled resource consumption. A security issue in Kubernetes (as described in CVE-2025-0426) allows an attacker to exploit the unauthenticated kubelet read-only HTTP endpoint by making a large number of container checkpoint requests, which can fill the Node's disk and cause a Denial of Service. To address this vulnerability, the sigs.k8s.io/azuredisk-csi-driver package required multiple significant changes to adapt to the Kubernetes upgrade.

Who does this affect?

You are affected if you are using a vulnerable version of the package.

Background info

sigs.k8s.io/azuredisk-csi-driver is vulnerable to Uncontrolled Resource Consumption in versions 1.32.0 - 1.32.1, 1.31.0 - 1.31.5, 1.30.0 - 1.30.9 and 0.3.0 - 1.29.13.