Incorrect Default Permissions Vulnerability in Cilium Operator
Summary
CVE-2022-29178: Incorrect Default Permissions in Cilium. Affects cilium-operator across 3 version ranges.
< 1.9.16
>= 1.10.0, < 1.10.11
>= 1.11.0, < 1.11.5
Fixed in 1.9.16, 1.10.11 or 1.11.5, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2022-29178 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium Operator is a component of Cilium, an open source software that provides network connectivity and load balancing for application workloads. It is designed to enhance security and performance in Kubernetes environments. Cilium Operator manages the lifecycle of Cilium in a Kubernetes cluster, ensuring its proper installation, configuration, and maintenance. However, a vulnerability has been discovered in Cilium Operator versions prior to 1.9.16, 1.10.11, and 1.11.15.
Vulnerability Detail
The vulnerability arises from an incorrect default permissions issue. It allows users belonging to the group ID 1000 on the host where Cilium is running to access the Cilium API via a Unix domain socket. This could potentially enable malicious users to compromise the integrity and availability of the system. The impact of this vulnerability is considered high, as it can lead to unauthorized access and potential system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.161.9.16 -
>= 1.10.0, < 1.10.111.10.11 -
>= 1.11.0, < 1.11.51.11.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can modify Cilium's DaemonSet to run with a specific command. The exact command can be found in the GitHub Security Advisory for this vulnerability. However, applying the patch by updating to the fixed versions is the recommended long-term solution.
Conclusion
The incorrect default permissions vulnerability in Cilium Operator can be mitigated by updating to fixed versions or applying the recommended workaround. It is crucial to promptly address this vulnerability to prevent unauthorized access and potential system compromise. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cilium-operator →
FAQ
Cilium Operator is a component of Cilium that manages the lifecycle of Cilium in a Kubernetes cluster.
The vulnerability allows unauthorized access to the Cilium API, potentially compromising system integrity and availability.
Versions prior to 1.9.16, 1.10.11, and 1.11.15 are affected.
Update Cilium Operator to versions 1.9.16, 1.10.11, or 1.11.5, which contain the necessary patch.
Yes, a temporary workaround is to modify Cilium's DaemonSet to run with a specific command. Refer to the GitHub Security Advisory for details.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium-operator.
