CVE-2023-34242: Cilium vulnerable to information leakage via incorrect ReferenceGrant handling
Impact
When the Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium gaining visibility of secrets (including certificates) and services across namespaces.
An attacker on an affected cluster can configure Cilium to use cluster secrets or communicate with services that it should not have access to.
Gateway API functionality is disabled by default.
Patches
This vulnerability is fixed in Cilium release 1.13.4.
Cilium versions <1.13 are not affected.
Workarounds
There is no workaround to this issue.
Acknowledgements The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @meyskens for investigating and fixing the issue.
For more information If you have any questions or comments about this advisory, please reach out on Slack.
As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
Other sources
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to version 1.13.4, when Gateway API is enabled in Cilium, the absence of a check on the namespace in which a ReferenceGrant is created could result in Cilium unintentionally gaining visibility of secrets (including certificates) and services across namespaces. An attacker on an affected cluster can leverage this issue to use cluster secrets that should not be visible to them, or communicate with services that they should not have access to. Gateway API functionality is disabled by default. This vulnerability is fixed in Cilium release 1.13.4. As a workaround, restrict the creation of ReferenceGrant resources to admin users by using Kubernetes RBAC.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/cilium/ciliumto a version that resolves this vulnerability.Fixed in 1.13.4 - Upgrade
Upgrade
cilium/ciliumto a version that resolves this vulnerability.Fixed in 1.13.4 - Configuration
Disable Gateway API in Cilium (Gateway API functionality is disabled by default). This avoids the ReferenceGrant namespace-check issue described as occurring only when Gateway API is enabled.
Cilium Gateway API Gateway API enabled = false - Configuration
Use Kubernetes RBAC to restrict creation of `ReferenceGrant` resources to admin users (workaround stated in the advisory).
Kubernetes RBAC ReferenceGrant resource creation permissions = admin-only
Event History
Frequently Asked Questions
What is CVE-2023-34242?
CVE-2023-34242 is a vulnerability in Cilium, a networking and security solution, where the absence of a namespace check could result in unauthorized visibility of secrets.
How severe is CVE-2023-34242?
CVE-2023-34242 has a severity value of 5.3, which is considered medium.
How does CVE-2023-34242 affect Cilium?
CVE-2023-34242 affects Cilium versions prior to 1.13.4 when the Gateway API is enabled, allowing unintended visibility of secrets.
How can I fix CVE-2023-34242 in Cilium?
To fix CVE-2023-34242, upgrade to Cilium version 1.13.4 or later.
Where can I find more information about CVE-2023-34242?
You can find more information about CVE-2023-34242 in the release notes and security advisories on the Cilium GitHub repository.