cvelistv5 - cve-2023-41332

cve-2023-41332

Vulnerability from cvelistv5

Published

2023-09-26 20:27

Modified

2024-09-23 20:30

Severity ?

3.5 (Low) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Summary

Denial of service via Kubernetes annotations in specific Cilium configurations

References

URL	Tags
security-advisories@github.com	https://github.com/cilium/cilium/pull/27597	Exploit, Issue Tracking, Patch
security-advisories@github.com	https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp	Exploit, Mitigation, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/pull/27597	Exploit, Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp	Exploit, Mitigation, Patch, Third Party Advisory

Impacted products

Vendor

Product

Version

▼

cilium

Version: >= 1.14.0, < 1.14.2
Version: >= 1.13.0, < 1.13.7
Version: < 1.12.14

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:01:34.337Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp"
          },
          {
            "name": "https://github.com/cilium/cilium/pull/27597",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cilium/cilium/pull/27597"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41332",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-23T20:30:32.107290Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-23T20:30:43.084Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cilium",
          "vendor": "cilium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.7"
            },
            {
              "status": "affected",
              "version": "\u003c 1.12.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium\u0027s Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium \u003e= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium \u003c= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755: Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-26T20:27:41.226Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp"
        },
        {
          "name": "https://github.com/cilium/cilium/pull/27597",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/pull/27597"
        }
      ],
      "source": {
        "advisory": "GHSA-24m5-r6hv-ccgp",
        "discovery": "UNKNOWN"
      },
      "title": "Denial of service via Kubernetes annotations in specific Cilium configurations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-41332",
    "datePublished": "2023-09-26T20:27:41.226Z",
    "dateReserved": "2023-08-28T16:56:43.367Z",
    "dateUpdated": "2024-09-23T20:30:43.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-41332\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-09-27T15:19:30.023\",\"lastModified\":\"2024-11-21T08:21:05.610\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium\u0027s Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium \u003e= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium \u003c= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.\\n\\n\"},{\"lang\":\"es\",\"value\":\"Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. En los cl\u00fasteres de Cilium donde el proxy de capa 7 de Cilium se ha deshabilitado, la creaci\u00f3n de cargas de trabajo con anotaciones `policy.cilium.io/proxy-visibility` (en Cilium versiones \u0026gt;= 1.13) o anotaciones `io.cilium.proxy-visibility` (en Cilium versiones \u0026lt;= 1.12) hace que el agente Cilium tenga un error de segmentaci\u00f3n en el nodo al que est\u00e1 asignada la carga de trabajo. El tr\u00e1fico existente en el nodo afectado seguir\u00e1 fluyendo, pero el agente Cilium en el nodo no podr\u00e1 procesar cambios en las cargas de trabajo que se ejecutan en el nodo. Esto tambi\u00e9n evitar\u00e1 que las cargas de trabajo puedan iniciarse en el nodo afectado. La denegaci\u00f3n de servicio se limitar\u00e1 al nodo en el que est\u00e1 programada la carga de trabajo; sin embargo, un atacante puede programar cargas de trabajo en el nodo de su elecci\u00f3n, lo que podr\u00eda dar lugar a ataques dirigidos. Este problema se resolvi\u00f3 en las versiones 1.14.2, 1.13.7 y 1.12.14 de Cilium. Los usuarios que no puedan actualizar pueden evitar este ataque de denegaci\u00f3n de servicio habilitando el proxy de capa 7.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.5,\"baseSeverity\":\"LOW\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.1,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.5,\"baseSeverity\":\"LOW\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.1,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.12.14\",\"matchCriteriaId\":\"35ABDE15-4D2F-4F82-BA90-6529DBA75C4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.13.0\",\"versionEndExcluding\":\"1.13.7\",\"matchCriteriaId\":\"FAD54EC5-459F-43CF-8C36-BB84717CD640\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.14.0\",\"versionEndExcluding\":\"1.14.2\",\"matchCriteriaId\":\"F8854A94-3A9D-4BCD-AC5C-2D8AEF70AA40\"}]}]}],\"references\":[{\"url\":\"https://github.com/cilium/cilium/pull/27597\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/cilium/cilium/pull/27597\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mitigation\",\"Patch\",\"Third Party Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2023-41332

Vulnerability from cvelistv5

ghsa-24m5-r6hv-ccgp

Vulnerability from github

Impact

Patches

Workarounds

For more information

gsd-2023-41332

Vulnerability from gsd

Tags

Sightings

Nomenclature