CVE-2023-39347: Cilium-Proxy Incorrect Network Policy Application
Summary
CVE-2023-39347: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects cilium-proxy across 3 version ranges.
< 1.12.14
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.2
Fixed in 1.12.14, 1.13.7 or 1.14.2, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-39347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides advanced network policies for Kubernetes workloads. Cilium-proxy is a component of Cilium that handles proxying and load balancing for network traffic. It is vulnerable to an issue where incorrect network policies can be applied due to the misuse of user-provided pod labels during pod updates.
Vulnerability Detail
An attacker with the ability to update pod labels can exploit this vulnerability to cause Cilium to apply incorrect network policies. When a pod is updated, Cilium incorrectly uses user-provided pod labels to select the policies that apply to the workload. This can impact Cilium network policies that use namespace, service account, or cluster constructs to restrict traffic. By providing non-existent construct names, an attacker can bypass all network policies applicable to the construct. For example, providing a pod with a non-existent namespace as the value of the io.kubernetes.pod.namespace label results in none of the namespaced CiliumNetworkPolicies applying to the pod. This vulnerability requires the attacker to have Kubernetes API Server access.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.141.12.14 -
>= 1.13.0, < 1.13.71.13.7 -
>= 1.14.0, < 1.14.21.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, an admission webhook can be used to prevent pod label updates to the k8s:io.kubernetes.pod.namespace and io.cilium.k8s.policy.* keys. This prevents the exploitation of the vulnerability by disallowing the use of non-existent construct names.
Conclusion
Cilium-proxy is vulnerable to incorrect network policy application due to the misuse of user-provided pod labels. This can be exploited by an attacker with Kubernetes API Server access to bypass network policies. Upgrading to the fixed versions or implementing the suggested workaround can mitigate this vulnerability.
See every vulnerability recorded for cilium-proxy →
FAQ
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides advanced network policies for Kubernetes workloads.
Cilium-proxy is a component of Cilium that handles proxying and load balancing for network traffic.
The vulnerability arises from the incorrect usage of user-provided pod labels during pod updates in Cilium-proxy. This allows an attacker to manipulate network policies by providing non-existent construct names.
By exploiting this vulnerability, an attacker can bypass network policies and potentially gain unauthorized access to network resources within the Kubernetes cluster.
To mitigate this vulnerability, it is recommended to upgrade to Cilium versions 1.14.2, 1.13.7, or 1.12.14. Alternatively, you can use an admission webhook to prevent pod label updates to specific keys.
References
Related vulnerabilities
Recent vulnerabilities recorded for cilium-proxy.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
