Log in Start free

Vulnerability · Published May 20, 2022 · Assigned by GitHub_M

CVE-2022-29178Incorrect Default Permissions in Cilium

High 8.8

In plain English

A high-severity incorrect default permissions in cilium from cilium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 78.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versions 1.9.16, 1.10.11, and 1.11.15 contains an incorrect default permissions vulnerability. Operating Systems with users belonging to the group ID 1000 can access the API of Cilium via Unix domain socket available on the host where Cilium is running. This could allow malicious users to compromise integrity as well as system availability on that host. The problem has been fixed and the patch is available in versions 1.9.16, 1.10.11, and 1.11.5. A potential workaround is to modify Cilium's DaemonSet to run with a certain command, which can be found in the GitHub Security Advisory for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/cilium/cilium1.11.5GHSA-6p8v-8cq8-v2r3
Gogithub.com/cilium/cilium1.10.11GHSA-6p8v-8cq8-v2r3
Gogithub.com/cilium/cilium1.9.16GHSA-6p8v-8cq8-v2r3
Gogithub.com/cilium/cilium1.10.11, 1.11.5, 1.9.16GO-2022-0457

Affected products (as reported)

VendorProductVersions
cilium cilium < 1.9.16>= 1.10.0, < 1.10.11>= 1.11.0, < 1.11.5

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References