CVE-2023-39347: Cilium Incorrect Network Policy Application
Summary
CVE-2023-39347: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects hubble across 3 version ranges.
< 1.12.14
>= 1.13.0, < 1.13.7
>= 1.14.0, < 1.14.2
Fixed in 1.12.14, 1.13.7 or 1.14.2, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/cilium/cilium · Go
- hubble-ui · Bitnami
- hubble-ui-backend · Bitnami
- cilium-proxy · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-39347 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides various features such as network policies that use constructs like namespace, service account, and cluster to restrict traffic. However, a vulnerability exists in Cilium versions prior to 1.12.14, 1.13.7, and 1.14.2 that allows an attacker with Kubernetes API Server access to apply incorrect network policies by manipulating pod labels.
Vulnerability Detail
The vulnerability arises from Cilium incorrectly using user-provided pod labels to select the policies that apply to a workload. By providing non-existent construct names as pod labels, an attacker can bypass network policies that would normally restrict traffic. For example, using a non-existent namespace label would cause none of the namespaced CiliumNetworkPolicies to apply to the targeted pod. This vulnerability can have significant security implications as it allows unauthorized traffic to flow freely within the affected Cilium deployment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.12.141.12.14 -
>= 1.13.0, < 1.13.71.13.7 -
>= 1.14.0, < 1.14.21.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, an admission webhook can be used to prevent pod label updates to the k8s:io.kubernetes.pod.namespace and io.cilium.k8s.policy.* keys. This prevents attackers from manipulating these labels to bypass network policies. Implementing the admission webhook requires modifying the Kubernetes configuration and deploying the webhook server. Detailed instructions for setting up an admission webhook can be found in the Cilium documentation.
Conclusion
The vulnerability in Cilium versions prior to 1.12.14, 1.13.7, and 1.14.2 allows attackers to bypass network policies by manipulating pod labels. To mitigate this vulnerability, it is recommended to upgrade to one of the fixed versions. Additionally, implementing an admission webhook can serve as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for hubble →
FAQ
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides advanced network policies and other features to enhance Kubernetes networking.
This vulnerability allows an attacker with Kubernetes API Server access to bypass network policies and potentially gain unauthorized access to the affected Cilium deployment.
Cilium versions prior to 1.12.14, 1.13.7, and 1.14.2 are affected by this vulnerability.
There are no known public exploits of this vulnerability at the time of this report.
You can use the Vulert Playground at Vulert Scanner to check if your Cilium deployment is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for vulnerabilities in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble.
