CVE-2023-41332

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium >= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium <= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/cilium/cilium/pull/27597	Exploit Issue Tracking Patch
https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp	Exploit Mitigation Patch Third Party Advisory
https://github.com/cilium/cilium/pull/27597	Exploit Issue Tracking Patch
https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp	Exploit Mitigation Patch Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cilium:cilium::::::::
	cpe:2.3:a:cilium:cilium::::::::
	cpe:2.3:a:cilium:cilium::::::::

History

21 Nov 2024, 08:21

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-27 15:19

Updated : 2024-11-21 08:21

NVD link : CVE-2023-41332

Mitre link : CVE-2023-41332

CVE.ORG link : CVE-2023-41332

JSON object : View

Products Affected

cilium

cilium

CWE

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2023-41332", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2023-09-27T15:19:30.023", "references": [{"url": "https://github.com/cilium/cilium/pull/27597", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp", "tags": ["Exploit", "Mitigation", "Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cilium/cilium/pull/27597", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/cilium/cilium/security/advisories/GHSA-24m5-r6hv-ccgp", "tags": ["Exploit", "Mitigation", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium >= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium <= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.\n\n"}, {"lang": "es", "value": "Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. En los cl\u00fasteres de Cilium donde el proxy de capa 7 de Cilium se ha deshabilitado, la creaci\u00f3n de cargas de trabajo con anotaciones `policy.cilium.io/proxy-visibility` (en Cilium versiones >= 1.13) o anotaciones `io.cilium.proxy-visibility` (en Cilium versiones <= 1.12) hace que el agente Cilium tenga un error de segmentaci\u00f3n en el nodo al que est\u00e1 asignada la carga de trabajo. El tr\u00e1fico existente en el nodo afectado seguir\u00e1 fluyendo, pero el agente Cilium en el nodo no podr\u00e1 procesar cambios en las cargas de trabajo que se ejecutan en el nodo. Esto tambi\u00e9n evitar\u00e1 que las cargas de trabajo puedan iniciarse en el nodo afectado. La denegaci\u00f3n de servicio se limitar\u00e1 al nodo en el que est\u00e1 programada la carga de trabajo; sin embargo, un atacante puede programar cargas de trabajo en el nodo de su elecci\u00f3n, lo que podr\u00eda dar lugar a ataques dirigidos. Este problema se resolvi\u00f3 en las versiones 1.14.2, 1.13.7 y 1.12.14 de Cilium. Los usuarios que no puedan actualizar pueden evitar este ataque de denegaci\u00f3n de servicio habilitando el proxy de capa 7."}], "lastModified": "2024-11-21T08:21:05.610", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35ABDE15-4D2F-4F82-BA90-6529DBA75C4F", "versionEndExcluding": "1.12.14"}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FAD54EC5-459F-43CF-8C36-BB84717CD640", "versionEndExcluding": "1.13.7", "versionStartIncluding": "1.13.0"}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8854A94-3A9D-4BCD-AC5C-2D8AEF70AA40", "versionEndExcluding": "1.14.2", "versionStartIncluding": "1.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}