The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
Exploiting Kubernetes’ Image Pull Implementation to Deny Node Availability
- Published
- Record updated
Summary
Researchers show that Kubernetes' lack of visibility into container image downloads, which sit behind the CRI-API, can be exploited for a Denial of Service attack on worker nodes. The attacks reportedly drive average CPU usage up to 95%, block new image downloads, and raise I/O and network usage for a potentially unlimited time. The authors argue a full fix needs a major architectural change to the Kubernetes and CRI-API relationship, which they consider unfeasible in the short term.
Mitigation
As a stopgap, the authors propose MAGI, an eBPF-based proof-of-concept mitigation that detects and terminates potential attacks.