GHSA-q7w8-72mr-vpgw BIT-cilium-2024-42488 BIT-cilium-operator-2024-42488 BIT-hubble-relay-2024-42488 CVE-2024-42488 GO-2024-3072
Policy bypass for Host Firewall policy due to race condition in Cilium agent
- Severity
- 6.8 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.50%
- Chance of exploitation in the next 30 days. Higher than 42.84% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- Fix
1.14.14- Upgrade github.com/cilium/cilium to this version or later
Description
Impact
A race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass.
Patches
This issue was fixed in https://github.com/cilium/cilium/pull/33511.
This issue affects:
- All versions of Cilium before v1.14.14
- Cilium v1.15 between v1.15.0 and v1.15.7 inclusive
This issue has been patched in:
- Cilium v1.14.14
- Cilium v1.15.8
Workarounds
As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.
Acknowledgements
The Cilium community has worked together with members of Google and Isovalent to prepare these mitigations. Special thanks to @skmatti for raising and resolving this issue.
For more information
If you have any questions or comments about this advisory, please reach out on Slack.
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/cilium/cilium | < 1.14.14 |
1.14.14 |
| github.com/cilium/cilium | >= 1.15.0, < 1.15.8 |
1.15.8 |
| github.com/cilium/cilium | < 1.14.14>= 1.15.0, < 1.15.8 |
1.14.141.15.8 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/cilium/cilium Go → 1.14.14
- go
go get github.com/cilium/cilium@v1.14.14 && go mod tidy
Severity breakdown
CVSS 3.1 6.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
How to prevent it
- Architecture and Design: In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
- Architecture and Design: Use thread-safe capabilities such as the data access abstraction in Spring.
- Architecture and Design: Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
- Implementation: When using multithreading and operating on shared variables, only use thread-safe functions.
- Implementation: Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
- Implementation: Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
- Implementation: Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
- Implementation: Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
- Implementation: Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
- Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
References
Advisories
Packages
Other links
- github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw
- github.com/cilium/cilium/pull/33511
- github.com/cilium/cilium/commit/7877db09b3f34d3081a1d66459b8fa6603dc3d30
- github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8
- github.com/cilium/cilium/commit/f81a1ee0cfdec928980db8640def984b2eeaa134
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fm8w-2m5w-9j7r Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match | Medium | Also affects github.com/cilium/cilium |
| GHSA-w7c2-w76w-5hmj Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces | High | Also affects github.com/cilium/cilium |
| GHSA-q6h5-q3q6-f87x CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation | Medium | Also affects github.com/cilium/cilium |
| GHSA-3fcv-jvfp-m4q9 Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access | High | Also affects github.com/cilium/cilium |
| GHSA-gj49-89wh-h4gj Cillium exposes sensitive information included in the cilium-bugtool debug archive | Medium | Also affects github.com/cilium/cilium |
| GHSA-hxv8-4j4r-cqgv Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic | Medium | Also affects github.com/cilium/cilium |
| GHSA-5r23-prx4-mqg3 Cilium may not enforce host firewall policies when Native Routing, WireGuard and Node Encryption are enabled | Medium | Also affects github.com/cilium/cilium |
| GHSA-38pp-6gcp-rqvm Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic | Medium | Also affects github.com/cilium/cilium |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor