CVE-2022-31077

    Dashboard / Vulnerabilities / CVE-2022-31077

    CVE-2022-31077

    Published: 27 Jun 2022Last Modified: 12 Aug 2026

    Summary: Malicious response from KubeEdge can crash CSI Driver controller server

    Details: KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a consequence, the CSI Driver controller will be in denial of service. This bug has been fixed in Kubeedge 1.11.0, 1.10.1, and 1.9.3. Users should update to these versions to resolve the issue. At the time of writing, no workaround exists.

    References: https://github.com/kubeedge/kubeedge/pull/3899/commits/5d60ae9eabd6b6b7afe38758e19bbe8137664701, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31077.json, https://github.com/kubeedge/kubeedge/security/advisories/GHSA-x938-fvfw-7jh5, https://nvd.nist.gov/vuln/detail/CVE-2022-31077, https://github.com/kubeedge/kubeedge/pull/3899

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -932e145484c86d47d8ae726607dc5fc2434c06a4

    Affected versions

    1.10.0-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31077 | CVE-DB