Vulnerability · Published Sep 26, 2023 · Assigned by GitHub_M

CVE-2023-41333Bypass of namespace restrictions in CiliumNetworkPolicy

Medium 6.9

In plain English

A medium-severity missing authentication in cilium from cilium. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.9Medium

Exploit odds (30 days)0.5%top 58.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace is able to affect traffic on an entire Cilium cluster, potentially bypassing policy enforcement in other namespaces. By using a crafted `endpointSelector` that uses the `DoesNotExist` operator on the `reserved:init` label, the attacker can create policies that bypass namespace restrictions and affect the entire Cilium cluster. This includes potentially allowing or denying all traffic. This attack requires API server access, as described in the Kubernetes API Server Attacker section of the Cilium Threat Model. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. As a workaround an admission webhook can be used to prevent the use of `endpointSelectors` that use the `DoesNotExist` operator on the `reserved:init` label in CiliumNetworkPolicies.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/cilium/cilium	1.14.2	GHSA-4xp2-w642-7mcx
Go	github.com/cilium/cilium	1.13.7	GHSA-4xp2-w642-7mcx
Go	github.com/cilium/cilium	1.12.14	GHSA-4xp2-w642-7mcx
Go	github.com/cilium/cilium	1.12.14, 1.13.7, 1.14.2	GO-2023-2080

Affected products (as reported)

Vendor	Product	Versions
cilium	cilium	>= 1.14.0, < 1.14.2>= 1.13.0, < 1.13.7< 1.12.14

Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H

References

https://github.com/cilium/cilium/security/advisories/GHSA-4xp2-w642-7mcx x_refsource_CONFIRM
https://github.com/cilium/cilium/pull/28007 x_refsource_MISC
https://docs.cilium.io/en/stable/security/threat-model/#kubernetes-api-server-attacker x_refsource_MISC