CVE-2022-29178: Cilium-Proxy Incorrect Default Permissions Vulnerability
Summary
CVE-2022-29178: Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Affects cilium-proxy across 3 version ranges.
< 1.9.16
>= 1.10.0, < 1.10.11
>= 1.11.0, < 1.11.5
Fixed in 1.9.16, 1.10.11 or 1.11.5, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2022-29178 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is an open source software that provides network connectivity and load balancing for application workloads. It is vulnerable to an incorrect default permissions issue in versions prior to 1.9.16, 1.10.11, and 1.11.15. This vulnerability allows users belonging to the group ID 1000 to access the Cilium API via the Unix domain socket on the host where Cilium is running. This could lead to integrity compromise and system availability issues on the affected host.
Vulnerability Detail
The vulnerability arises from the incorrect default permissions in Cilium. Users in the group ID 1000 can exploit this issue by accessing the API via the Unix domain socket. This can result in compromising the integrity and availability of the system. The issue has been addressed in versions 1.9.16, 1.10.11, and 1.11.5.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.161.9.16 -
>= 1.10.0, < 1.10.111.10.11 -
>= 1.11.0, < 1.11.51.11.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A potential workaround is to modify Cilium's DaemonSet to run with a certain command. The specific command can be found in the GitHub Security Advisory for this vulnerability.
Conclusion
The Cilium-Proxy Incorrect Default Permissions Vulnerability in versions prior to 1.9.16, 1.10.11, and 1.11.15 allows unauthorized access to the Cilium API, potentially leading to integrity compromise and system availability issues. It is crucial to update to the patched versions or apply the provided workaround to mitigate the risk.
See every vulnerability recorded for cilium-proxy →
FAQ
Cilium is open source software that provides network connectivity and load balancing for application workloads.
The vulnerability allows users in the group ID 1000 to access the Cilium API, potentially compromising system integrity and availability.
Versions prior to 1.9.16, 1.10.11, and 1.11.15 are affected.
Update Cilium to versions 1.9.16, 1.10.11, or 1.11.5.
Yes, modifying Cilium's DaemonSet with a specific command can serve as a workaround. Refer to the GitHub Security Advisory for details.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium-proxy.
