Cilium Networking Policies Bypass Vulnerability in Bitnami Cilium
Summary
CVE-2023-39347: Cilium NetworkPolicy bypass via pod labels. Affects cilium across 3 version ranges.
< 1.12.14
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.2
Fixed in 1.12.14, 1.13.7 or 1.14.2, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-39347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bitnami Cilium is a networking, observability, and security solution that utilizes an eBPF-based dataplane. It is designed to provide advanced networking features and policy enforcement for Kubernetes clusters. Cilium allows users to define network policies based on various constructs such as namespaces, service accounts, and clusters to restrict traffic within the cluster. However, a vulnerability has been discovered in Cilium versions prior to 1.12.14, 1.13.7, and 1.14.2 that can be exploited by an attacker with Kubernetes API Server access to bypass network policies by manipulating pod labels.
Vulnerability Detail
The vulnerability arises from Cilium's incorrect usage of user-provided pod labels during pod updates. When a pod is updated, Cilium uses the pod labels to select the network policies that should apply to the workload. However, this process is flawed as it allows an attacker to provide non-existent construct names as labels, effectively bypassing all network policies associated with that construct. For example, by providing a non-existent namespace as the value of the io.kubernetes.pod.namespace label, none of the namespaced CiliumNetworkPolicies will apply to the pod. This vulnerability can have severe consequences as it allows unauthorized traffic to flow within the cluster, potentially compromising the security and integrity of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.141.12.14 -
>= 1.13.0, < 1.13.71.13.7 -
>= 1.14.0, < 1.14.21.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, an admission webhook can be implemented to prevent pod label updates to the k8s:io.kubernetes.pod.namespace and io.cilium.k8s.policy.* keys. This will help mitigate the risk of exploiting the vulnerability until the affected Cilium version can be upgraded.
Conclusion
The Cilium Networking Policies Bypass Vulnerability in Bitnami Cilium allows attackers with Kubernetes API Server access to bypass network policies by manipulating pod labels. This can result in unauthorized traffic within the cluster, compromising the security and integrity of the system. Users are advised to upgrade to the latest versions of Cilium (1.12.14, 1.13.7, or 1.14.2) to mitigate the risk. A temporary workaround is to implement an admission webhook to prevent pod label updates. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cilium →
FAQ
Cilium is a networking, observability, and security solution for Kubernetes clusters. It provides advanced networking features and policy enforcement using an eBPF-based dataplane.
This vulnerability allows an attacker with Kubernetes API Server access to bypass network policies in Cilium by manipulating pod labels. It can result in unauthorized traffic flowing within the cluster, compromising the security and integrity of the system.
Cilium versions prior to 1.12.14, 1.13.7, and 1.14.2 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to the latest versions of Cilium (1.12.14, 1.13.7, or 1.14.2) that include the necessary patches.
Yes, a temporary workaround is to implement an admission webhook to prevent pod label updates to the k8s:io.kubernetes.pod.namespace and io.cilium.k8s.policy.* keys.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium.
