GHSA-fm8w-2m5w-9j7r: Medium severity go/github.com/cilium/cilium vulnerability
Impact
Standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule under specific cluster configurations.
When Cilium deployment is configured with a specific custom clusterName (rather than the default "any" value), the parser incorrectly instantiates a pod selector on selectorless peer definitions. This leads to Cilium appending an unintended wildcard namespace label selector to the policy's allowed Layer 3 rules, which allows traffic from other workloads in the same namespace as the subject of the policy.
Example policy affected by this issue: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: test-server namespace: default spec: podSelector: matchLabels: app: test-server policyTypes: - Ingress ingress: - from: - ipBlock: cidr: 192.0.2.3
In affected versions, this policy erroneously allows the test-server Pod in the default namespace to receive any traffic from other workloads running in the default namespace.
Patches
This issue has been patched in:
- Cilium v1.19.5
Releases below v1.19.0 are not affected.
This issue affects:
- Cilium v1.19 between v1.19.0 and v1.19.4 inclusive
Workarounds
Developers can create the equivalent policy using CiliumNetworkPolicy fromCIDR expressions. CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy are not affected by this issue.
Acknowledgements
Special thanks to @TheBeeZee for reporting this issue and preparing the fix, and to @fristonio and @odinuge for their assistance in reviewing the solution.
For more information
If a vulnerability affecting Cilium appears to have been found, the Cilium security team strongly encourages reporting it to the security mailing list at security@cilium.io. This is a private mailing list for the Cilium security team, and the report will be treated as top priority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/cilium/ciliumto a version that resolves this vulnerability.Fixed in 1.19.5 - Upgrade
Upgrade
Ciliumto a version that resolves this vulnerability.Fixed in v1.19.4 - Upgrade
Upgrade
Ciliumto a version that resolves this vulnerability.Fixed in v1.19.5
Event History
Frequently Asked Questions
Which deployments are exposed to this policy bypass?
Deployments are affected when Cilium uses a custom clusterName instead of the default "any" value and a Kubernetes NetworkPolicy contains a CIDR-based ipBlock peer without pod or namespace selectors. The issue affects Cilium versions from v1.19.0 up to, but not including, v1.19.5; releases below v1.19.0 are not affected.
What access or traffic source is required to exploit the issue?
An attacker needs a workload running in the same namespace as the pod selected by the affected NetworkPolicy. That workload can send traffic to the selected pod even when the policy's ingress rule was intended to allow only the specified CIDR.
How can I identify policies that may be affected?
Review NetworkPolicy ingress rules for from entries that use ipBlock CIDRs without podSelector or namespaceSelector fields. Prioritize policies protecting pods in clusters where Cilium has been configured with a custom clusterName.
What should be done if upgrading is not immediately possible?
Avoid relying on selectorless CIDR-based ipBlock peers for ingress isolation in deployments using a custom Cilium clusterName. Restrict or separate untrusted workloads from the namespace containing the policy-selected pods until Cilium can be updated to v1.19.5.