CVE-2023-27594: Cilium Misattributed Source IP Address
Summary
CVE-2023-27594: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects hubble across 3 version ranges.
< 1.11.15
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.1
Fixed in 1.11.15, 1.12.8 or 1.13.1, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui-backend · Bitnami
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-27594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides features such as network policies and routing for Kubernetes clusters. Cilium uses eBPF (extended Berkeley Packet Filter) to capture and process network traffic at the kernel level, enabling advanced networking capabilities.
Vulnerability Detail
Under specific conditions, Cilium versions prior to 1.11.15, 1.12.8, and 1.13.1 may misattribute the source IP address of traffic to a cluster, incorrectly identifying external traffic as originating from the host on which Cilium is running. This misattribution can lead to bypassing network policies for the affected cluster, potentially allowing unauthorized access or traffic manipulation. The issue specifically occurs when Cilium is routing IPv6 traffic and NodePorts are used to route traffic to pods. IPv6 routing and endpoint routes are disabled by default.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15 -
>= 1.12.0, < 1.12.81.12.8 -
>= 1.13.0, < 1.13.11.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, disabling IPv6 routing can mitigate the issue. This can be achieved by modifying the Cilium configuration to ensure IPv6 routing is disabled. Refer to the Cilium documentation for instructions on how to disable IPv6 routing.
Conclusion
The vulnerability in Cilium versions prior to 1.11.15, 1.12.8, and 1.13.1 can result in misattributed source IP addresses and bypassing of network policies. It is recommended to upgrade to the fixed versions or apply the workaround of disabling IPv6 routing. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for hubble →
FAQ
Cilium is a networking, observability, and security solution for Kubernetes clusters. It uses eBPF-based dataplane to provide advanced networking capabilities.
Versions of Cilium prior to 1.11.15, 1.12.8, and 1.13.1 are affected by this vulnerability.
The misattribution of source IP addresses can lead to bypassing network policies, potentially allowing unauthorized access or traffic manipulation within the affected cluster.
No, IPv6 routing and endpoint routes are disabled by default in Cilium.
You can check the version of Cilium by running the 'cilium status' command in your Kubernetes environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble.
