CVE-2023-39347
Vulnerability from cvelistv5
Published
2023-09-26 18:30
Modified
2024-09-24 13:45
Severity ?
EPSS score ?
Summary
Cilium NetworkPolicy bypass via pod labels
References
| ▼ | URL | Tags | |
|---|---|---|---|
| security-advisories@github.com | https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker | Exploit, Technical Description, Vendor Advisory | |
| security-advisories@github.com | https://github.com/cilium/cilium/security/advisories/GHSA-gj2r-phwg-6rww | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker | Exploit, Technical Description, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/cilium/cilium/security/advisories/GHSA-gj2r-phwg-6rww | Vendor Advisory |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.927Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/cilium/cilium/security/advisories/GHSA-gj2r-phwg-6rww",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-gj2r-phwg-6rww"
},
{
"name": "https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39347",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-24T13:24:24.851028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T13:45:29.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cilium",
"vendor": "cilium",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.14.0, \u003c 1.14.2"
},
{
"status": "affected",
"version": "\u003e= 1.13.0, \u003c 1.13.7 "
},
{
"status": "affected",
"version": "\u003c 1.12.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on pod update, Cilium incorrectly uses user-provided pod labels to select the policies which apply to the workload in question. This can affect Cilium network policies that use the namespace, service account or cluster constructs to restrict traffic, Cilium clusterwide network policies that use Cilium namespace labels to select the Pod and Kubernetes network policies. Non-existent construct names can be provided, which bypass all network policies applicable to the construct. For example, providing a pod with a non-existent namespace as the value of the `io.kubernetes.pod.namespace` label results in none of the namespaced CiliumNetworkPolicies applying to the pod in question. This attack requires the attacker to have Kubernetes API Server access, as described in the Cilium Threat Model. This issue has been resolved in: Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users are advised to upgrade. As a workaround an admission webhook can be used to prevent pod label updates to the `k8s:io.kubernetes.pod.namespace` and `io.cilium.k8s.policy.*` keys."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-26T18:30:00.635Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cilium/cilium/security/advisories/GHSA-gj2r-phwg-6rww",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cilium/cilium/security/advisories/GHSA-gj2r-phwg-6rww"
},
{
"name": "https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker"
}
],
"source": {
"advisory": "GHSA-gj2r-phwg-6rww",
"discovery": "UNKNOWN"
},
"title": "Cilium NetworkPolicy bypass via pod labels"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-39347",
"datePublished": "2023-09-26T18:30:00.635Z",
"dateReserved": "2023-07-28T13:26:46.477Z",
"dateUpdated": "2024-09-24T13:45:29.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-39347\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-09-27T15:18:55.747\",\"lastModified\":\"2024-11-21T08:15:12.350\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels can cause Cilium to apply incorrect network policies. This issue arises due to the fact that on pod update, Cilium incorrectly uses user-provided pod labels to select the policies which apply to the workload in question. This can affect Cilium network policies that use the namespace, service account or cluster constructs to restrict traffic, Cilium clusterwide network policies that use Cilium namespace labels to select the Pod and Kubernetes network policies. Non-existent construct names can be provided, which bypass all network policies applicable to the construct. For example, providing a pod with a non-existent namespace as the value of the `io.kubernetes.pod.namespace` label results in none of the namespaced CiliumNetworkPolicies applying to the pod in question. This attack requires the attacker to have Kubernetes API Server access, as described in the Cilium Threat Model. This issue has been resolved in: Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users are advised to upgrade. As a workaround an admission webhook can be used to prevent pod label updates to the `k8s:io.kubernetes.pod.namespace` and `io.cilium.k8s.policy.*` keys.\"},{\"lang\":\"es\",\"value\":\"Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Un atacante con la capacidad de actualizar las etiquetas de los pods puede hacer que Cilium aplique pol\u00edticas de red incorrectas. Este problema surge debido al hecho de que en la actualizaci\u00f3n del pod, Cilium utiliza incorrectamente etiquetas de pod proporcionadas por el usuario para seleccionar las pol\u00edticas que se aplican a la carga de trabajo en cuesti\u00f3n. Esto puede afectar las pol\u00edticas de red de Cilium que usan el espacio de nombres, la cuenta de servicio o las construcciones de cl\u00faster para restringir el tr\u00e1fico, las pol\u00edticas de red de todo el cl\u00faster de Cilium que usan etiquetas de espacio de nombres de Cilium para seleccionar las pol\u00edticas de red de Pod y Kubernetes. Se pueden proporcionar nombres de construcciones inexistentes, que omiten todas las pol\u00edticas de red aplicables a la construcci\u00f3n. Por ejemplo, proporcionar un pod con un espacio de nombres inexistente como valor de la etiqueta `io.kubernetes.pod.namespace` da como resultado que ninguna de las CiliumNetworkPolicies con espacios de nombres se aplique al pod en cuesti\u00f3n. Este ataque requiere que el atacante tenga acceso al servidor API de Kubernetes, como se describe en el modelo de amenazas de Cilium. Este problema se resolvi\u00f3 en: Cilium versiones 1.14.2, 1.13.7 y 1.12.14. Se recomienda a los usuarios que actualicen. Como workaround, se puede utilizar un webhook de admisi\u00f3n para evitar actualizaciones de etiquetas de pod en las claves `k8s:io.kubernetes.pod.namespace` y `io.cilium.k8s.policy.*`.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":9.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.3,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.12.14\",\"matchCriteriaId\":\"35ABDE15-4D2F-4F82-BA90-6529DBA75C4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.13.0\",\"versionEndExcluding\":\"1.13.7\",\"matchCriteriaId\":\"FAD54EC5-459F-43CF-8C36-BB84717CD640\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.14.0\",\"versionEndExcluding\":\"1.14.2\",\"matchCriteriaId\":\"F8854A94-3A9D-4BCD-AC5C-2D8AEF70AA40\"}]}]}],\"references\":[{\"url\":\"https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Technical Description\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/cilium/cilium/security/advisories/GHSA-gj2r-phwg-6rww\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://docs.cilium.io/en/latest/security/threat-model/#kubernetes-api-server-attacker\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Technical Description\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/cilium/cilium/security/advisories/GHSA-gj2r-phwg-6rww\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.