Misattribution of Source IP Address in Cilium Operator
Summary
CVE-2023-27594: Cilium vulnerable to potential network policy bypass when routing IPv6 traffic. Affects cilium-operator across 3 version ranges.
< 1.11.15
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.1
Fixed in 1.11.15, 1.12.8 or 1.13.1, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui-backend · Bitnami
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-27594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides advanced features for managing network policies and routing traffic within a Kubernetes cluster. The Cilium Operator is a component that automates the deployment and management of Cilium in a Kubernetes environment.
Vulnerability Detail
Under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, incorrectly identifying external traffic as originating from the host on which Cilium is running. This vulnerability can potentially bypass network policies for the affected cluster, depending on the specific policies in place. The issue only occurs when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. By default, IPv6 routing and endpoint routes are disabled.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15 -
>= 1.12.0, < 1.12.81.12.8 -
>= 1.13.0, < 1.13.11.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, disabling IPv6 routing can mitigate the vulnerability. This can be achieved by modifying the Cilium configuration to explicitly disable IPv6 routing. The exact steps to perform this workaround depend on the specific deployment and configuration of Cilium in the Kubernetes cluster.
Conclusion
The misattribution of source IP address vulnerability in Cilium Operator can potentially bypass network policies and allow external traffic to be misidentified. It is crucial to upgrade to the fixed versions of Cilium to mitigate this vulnerability. Disabling IPv6 routing can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cilium-operator →
FAQ
Cilium is a networking, observability, and security solution for Kubernetes, utilizing eBPF-based dataplane technology.
The Cilium Operator is a component that automates the deployment and management of Cilium in a Kubernetes environment.
The vulnerability can potentially bypass network policies for the affected cluster, allowing external traffic to be misattributed and potentially bypassing the intended restrictions.
No, the vulnerability only manifests when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. IPv6 routing and endpoint routes are disabled by default.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it for vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium-operator.
