Misattribution of Source IP Address in Cilium
Summary
CVE-2023-27594: Cilium vulnerable to potential network policy bypass when routing IPv6 traffic. Affects cilium across 3 version ranges.
< 1.11.15
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.1
Fixed in 1.11.15, 1.12.8 or 1.13.1, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui-backend · Bitnami
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-27594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It is designed to provide advanced networking features and enhance security for containerized applications. Cilium utilizes eBPF (extended Berkeley Packet Filter) to enable deep visibility and control over network traffic within a Kubernetes cluster.
Vulnerability Detail
Under specific conditions, Cilium versions prior to 1.11.15, 1.12.8, and 1.13.1 may misattribute the source IP address of traffic to a cluster, incorrectly identifying external traffic as originating from the host on which Cilium is running. This misattribution can lead to bypassing network policies for the affected cluster, potentially compromising the security of the network. The issue arises when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. It is important to note that IPv6 routing and endpoint routes are disabled by default.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15 -
>= 1.12.0, < 1.12.81.12.8 -
>= 1.13.0, < 1.13.11.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, disabling IPv6 routing can mitigate the risk associated with this vulnerability. By disabling IPv6 routing, the conditions that trigger the misattribution of source IP address are not met. However, this workaround may not be feasible in all scenarios, especially if IPv6 routing is required for specific network configurations.
Conclusion
The misattribution of source IP address in Cilium can lead to bypassing network policies and compromise the security of a Kubernetes cluster. It is crucial to upgrade to the fixed versions or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cilium →
FAQ
Cilium is a networking, observability, and security solution for containerized applications. It leverages eBPF to provide advanced networking features and enhance security within Kubernetes clusters.
Versions of Cilium prior to 1.11.15, 1.12.8, and 1.13.1 are affected by this vulnerability.
The misattribution of source IP address can lead to bypassing network policies for a cluster, potentially compromising the security of the network. It allows external traffic to be incorrectly identified as originating from the host running Cilium.
No, IPv6 routing and endpoint routes are disabled by default in Cilium.
To fix this vulnerability, it is recommended to upgrade to Cilium versions 1.11.15, 1.12.8, or 1.13.1. These versions contain the necessary fixes to correctly attribute the source IP address of traffic.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium.
