Apache YuniKorn is a light-weight, universal resource scheduler for container orchestrator systems. It is created to achieve fine-grained resource sharing for various workloads efficiently on a large scale, multi-tenant, and cloud-native environment. YuniKorn brings a unified, cross-platform, scheduling experience for mixed workloads that consist of stateless batch workloads and stateful services.
Apache YuniKorn's LDAP user/group resolver crashes (panics) when parsing an LDAP 'memberOf' attribute whose value does not contain the substring "CN=". In usergroup_ldap_resolver.go the group name is extracted with strings.Split(s[0], "CN=") followed by an unchecked access to newgroup[1]; when the split yields a single-element slice (any memberOf value lacking "CN="), the index-out-of-range access raises a runtime panic and terminates the resolver.
Triggering the issue requires a non-default deployment (the LDAP group provider configured, with an LDAP server that returns lower-case attribute names or a non-standard schema) and an attacker with permission to run a workload on the Kubernetes cluster whose pod specifies a user for which the LDAP server returns such a memberOf entry.