CVE-2023-27593: Cilium - Unauthorized Write Access to CNI Binary
Summary
CVE-2023-27593: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Affects hubble-ui-backend across 3 version ranges.
< 1.11.15
>= 1.12.0, < 1.12.8
>= 1.13.0, < 1.13.1
Fixed in 1.11.15, 1.12.8 or 1.13.1, depending on the release line you run. How to fix ↓
Also tracked for
- hubble-ui · Bitnami
- cilium-proxy · Bitnami
- hubble · Bitnami
- hubble-relay · Bitnami
- cilium · Bitnami
- cilium-operator · Bitnami
- github.com/cilium/cilium · Go
The same CVE-2023-27593 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. It provides enhanced networking capabilities and security features for Kubernetes clusters. The Cilium agent pod is responsible for managing network policies and security enforcement. It relies on the CNI (Container Network Interface) binary located in the /opt/cni/bin directory to perform its functions.
Vulnerability Detail
An attacker with access to a Cilium agent pod can exploit a vulnerability in versions prior to 1.11.15, 1.12.8, and 1.13.1. The vulnerability arises from a hostPath mount of the /opt/cni/bin directory in the agent pod. By replacing the legitimate CNI binary with a malicious one and waiting for the creation of a new pod on the node, the attacker can gain unauthorized access to the underlying node. This can lead to various security breaches and compromise the integrity of the entire Kubernetes cluster.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.11.151.11.15 -
>= 1.12.0, < 1.12.81.12.8 -
>= 1.13.0, < 1.13.11.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Cilium is not immediately feasible, a workaround is available. Kubernetes RBAC (Role-Based Access Control) can be used to deny users and service accounts exec access to Cilium agent pods. By restricting exec access, the risk of unauthorized access to the underlying node can be mitigated. However, this workaround may impact legitimate use cases where exec access to Cilium agent pods is required.
Conclusion
The vulnerability in Cilium versions prior to 1.11.15, 1.12.8, and 1.13.1 allows unauthorized write access to the CNI binary, potentially leading to unauthorized access to the underlying node. It is crucial to update Cilium to the fixed versions or apply the recommended workaround to mitigate the risk. Regularly monitoring for vulnerabilities using tools like Vulert can help ensure the security of your software.
See every vulnerability recorded for hubble-ui-backend →
FAQ
Cilium is a networking, observability, and security solution for Kubernetes clusters. It provides enhanced networking capabilities and security features using an eBPF-based dataplane.
The vulnerability allows an attacker with access to a Cilium agent pod to gain unauthorized access to the underlying node. This can lead to security breaches and compromise the integrity of the Kubernetes cluster.
To fix this vulnerability, update Cilium to versions 1.11.15, 1.12.8, or 1.13.1. These versions contain the necessary fixes to prevent unauthorized write access to the CNI binary.
Yes, a workaround is available by using Kubernetes RBAC to deny exec access to Cilium agent pods. However, this may impact legitimate use cases where exec access is required.
More information about this vulnerability can be found in the Cilium documentation and the associated CVE entry.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubble-ui-backend.
