Community post originally published on the OSTIF blog
Open Source Technology Improvement Fund (ostif.org) is thrilled to report the results of a security audit of KubeEdge. KubeEdge is an edge computing framework built on top of Kubernetes and extends native containerized application orchestration and management to hosts at the edge.
The result of this engagement is the finding and fixing of multiple medium severity issues, threat modeling, and integration to OSS Fuzz. 10 fuzzers in total were written, and these fuzzers were set up to run in the CI for pull requests. Several issues were found by the fuzzers, including 2 of the 8 CVEs.
The KubeEdge team demonstrated a strong commitment to security and was fast to reproduce crashes and respond with patches. This type of engagement and collaboration from project maintainers helps the security audit process be more effective and impactful. We thank Kevin Wang, Fisher Xu, Vincent Lin and everyone who helped with this engagement.
Thank you to Cloud Native Computing Foundation (CNCF) for funding this audit and entrusting Open Source Technology Improvement Fund to facilitate it. Special thanks to David Korczynski and Adam Korczynski of Ada Logics for conducting the audit.
Everyone around the world depends on OSS. We’d love to do more security audits to proactively find and fix vulnerabilities! If you’re interested in financially supporting this work, contact amir@ostif.org.
References: