CVE-2022-29178: Cilium Incorrect Default Permissions Vulnerability in Hubble
Summary
CVE-2022-29178: Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Affects hubble across 3 version ranges.
< 1.9.16
>= 1.10.0, < 1.10.11
>= 1.11.0, < 1.11.5
Fixed in 1.9.16, 1.10.11 or 1.11.5, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2022-29178 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hubble is an open source software developed by Bitnami that provides and secures network connectivity and load balancing between application workloads. It is designed to enhance network visibility and security in Kubernetes environments. Hubble utilizes Cilium, an open source networking and security project, to manage network connectivity. Cilium allows users to access its API via a Unix domain socket on the host where it is running. However, versions prior to 1.9.16, 1.10.11, and 1.11.15 of Cilium have an incorrect default permissions vulnerability. This vulnerability allows users belonging to the group ID 1000 to access the Cilium API, potentially compromising the integrity and availability of the system.
Vulnerability Detail
The incorrect default permissions vulnerability in Cilium allows unauthorized users to access the API via the Unix domain socket. This can be exploited by malicious users who have access to the host where Cilium is running. By accessing the API, these users can compromise the integrity and availability of the system. The vulnerability has been addressed in versions 1.9.16, 1.10.11, and 1.11.5 of Cilium.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.9.161.9.16 -
>= 1.10.0, < 1.10.111.10.11 -
>= 1.11.0, < 1.11.51.11.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A potential workaround for this vulnerability is to modify Cilium's DaemonSet to run with a specific command. The command can be found in the GitHub Security Advisory for this vulnerability. Implementing this workaround can help mitigate the risk until the Cilium update can be applied.
Conclusion
The incorrect default permissions vulnerability in Cilium can be mitigated by updating to versions 1.9.16, 1.10.11, or 1.11.5. A workaround is also available by modifying Cilium's DaemonSet. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hubble →
FAQ
This vulnerability allows unauthorized users to access the Cilium API, potentially compromising the integrity and availability of the system.
Versions prior to 1.9.16, 1.10.11, and 1.11.15 of Cilium are affected by this vulnerability.
To fix this vulnerability, update Cilium to versions 1.9.16, 1.10.11, or 1.11.5.
Yes, a workaround is available by modifying Cilium's DaemonSet to run with a specific command.
More information about this vulnerability can be found in the GitHub Security Advisory for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble.
