Vulnerability · Published Aug 15, 2024 · Assigned by GitHub_M
CVE-2024-42488Cilium agent's race condition may lead to policy bypass for Host Firewall policy
Medium 6.8
In plain English
A medium-severity race condition in cilium from cilium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/cilium/cilium | 1.14.14 | GHSA-q7w8-72mr-vpgw |
| Go | github.com/cilium/cilium | 1.15.8 | GHSA-q7w8-72mr-vpgw |
| Go | github.com/cilium/cilium | 1.14.14, 1.15.8 | GO-2024-3072 |
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw x_refsource_CONFIRM
- https://github.com/cilium/cilium/pull/33511 x_refsource_MISC
- https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8 x_refsource_MISC