CVE-2024-42488

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8	Patch
https://github.com/cilium/cilium/pull/33511	Patch Third Party Advisory
https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cilium:cilium::::::::
	cpe:2.3:a:cilium:cilium::::::::

History

No history.

Information

Published : 2024-08-15 21:15

Updated : 2024-09-27 18:49

NVD link : CVE-2024-42488

Mitre link : CVE-2024-42488

CVE.ORG link : CVE-2024-42488

JSON object : View

Products Affected

cilium

cilium

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2024-42488", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.2}]}, "published": "2024-08-15T21:15:17.270", "references": [{"url": "https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/pull/33511", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected."}, {"lang": "es", "value": "Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Antes de las versiones 1.14.14 y 1.15.8, una condici\u00f3n de ejecuci\u00f3n en el agente Cilium puede hacer que el agente ignore las etiquetas que deber\u00edan aplicarse a un nodo. Esto, a su vez, podr\u00eda provocar que las CiliumClusterwideNetworkPolicies destinadas a nodos con la etiqueta ignorada no se apliquen, lo que provocar\u00eda una omisi\u00f3n de pol\u00edticas. Este problema se solucion\u00f3 en Cilium v1.14.14 y v1.15.8. Como el problema subyacente depende de una condici\u00f3n de ejecuci\u00f3n, los usuarios que no pueden actualizar pueden reiniciar el agente Cilium en los nodos afectados hasta que se confirme que las pol\u00edticas afectadas funcionan como se esperaba."}], "lastModified": "2024-09-27T18:49:05.410", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BE0B7D1-49C5-4604-AE7D-4E809E169BE5", "versionEndExcluding": "1.14.14"}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0C8F90D-07B3-4666-8C22-089A2DA27A03", "versionEndExcluding": "1.15.8", "versionStartIncluding": "1.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}