Cilium Operator - Incorrect Network Policy Application
Summary
CVE-2023-39347: Cilium NetworkPolicy bypass via pod labels. Affects cilium-operator across 3 version ranges.
< 1.12.14
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.2
Fixed in 1.12.14, 1.13.7 or 1.14.2, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-39347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium Operator is a networking, observability, and security solution that utilizes an eBPF-based dataplane. It is designed to enhance network connectivity and enforce security policies within Kubernetes clusters. Cilium Operator is responsible for managing and applying network policies to workloads.
Vulnerability Detail
The vulnerability in Cilium Operator allows an attacker with the ability to update pod labels to cause incorrect network policies to be applied. This occurs because Cilium Operator incorrectly uses user-provided pod labels to select the policies that should apply to a workload. By providing non-existent construct names, such as a non-existent namespace, an attacker can bypass network policies that restrict traffic. This vulnerability requires the attacker to have access to the Kubernetes API Server. The impact of this vulnerability includes the potential bypassing of network policies that use namespace, service account, or cluster constructs to restrict traffic.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.141.12.14 -
>= 1.13.0, < 1.13.71.13.7 -
>= 1.14.0, < 1.14.21.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, an admission webhook can be implemented to prevent pod label updates to the k8s:io.kubernetes.pod.namespace and io.cilium.k8s.policy.* keys. This can help mitigate the risk of incorrect network policy application until the upgrade to a fixed version of Cilium can be performed. The implementation of the admission webhook should be done following the guidelines provided by Kubernetes.
Conclusion
The vulnerability in Cilium Operator allows an attacker to bypass network policies by providing non-existent construct names as pod labels. This can result in the incorrect application of network policies that restrict traffic. Users are advised to upgrade to the fixed versions of Cilium and follow the recommended upgrade process. In the meantime, implementing an admission webhook can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cilium-operator →
FAQ
Cilium Operator is a networking, observability, and security solution for Kubernetes clusters. It utilizes an eBPF-based dataplane to enhance network connectivity and enforce security policies.
This vulnerability allows an attacker to bypass network policies by providing non-existent construct names as pod labels. It can result in the incorrect application of network policies that restrict traffic.
The attacker needs access to the Kubernetes API Server to exploit this vulnerability.
To fix this vulnerability, upgrade to Cilium versions 1.14.2, 1.13.7, or 1.12.14. Follow the official upgrade documentation provided by Cilium for a smooth transition.
Yes, a workaround is available. Implement an admission webhook to prevent pod label updates to specific keys. Refer to Kubernetes documentation for guidance on implementing admission webhooks.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium-operator.
