PT-2023-24766 · Cilium · Cilium

Meyskens · Published 2023-06-15 · Updated 2024-08-20 · CVE-2023-34242

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cilium versions prior to 1.13.4

Description The issue arises when Gateway API is enabled in Cilium, allowing an attacker on an affected cluster to leverage the absence of a check on the namespace in which a ReferenceGrant is created. This could result in Cilium unintentionally gaining visibility of secrets, including certificates, and services across namespaces. An attacker can use cluster secrets that should not be visible to them or communicate with services they should not have access to. Gateway API functionality is disabled by default.

Recommendations As a temporary workaround, restrict the creation of ReferenceGrant resources to admin users by using Kubernetes RBAC. Update to Cilium release 1.13.4 or later to fix the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-CILIUM-2023-34242

BIT-CILIUM-OPERATOR-2023-34242

BIT-CILIUM-PROXY-2023-34242

BIT-HUBBLE-2023-34242

BIT-HUBBLE-RELAY-2023-34242

BIT-HUBBLE-UI-2023-34242

BIT-HUBBLE-UI-BACKEND-2023-34242

CVE-2023-34242

GHSA-R7WR-4W5Q-55M6

GO-2023-1862

Affected Products

Cilium

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34242.json · Exploit
• https://osv.dev/vulnerability/BIT-hubble-ui-backend-2023-34242 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1862 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-operator-2023-34242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34242 · Security Note
• https://osv.dev/vulnerability/BIT-hubble-relay-2023-34242 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7wr-4w5q-55m6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-ui-2023-34242 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2023-34242 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-2023-34242 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-proxy-2023-34242 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34242 · Vendor Advisory
• https://github.com/cilium/cilium · Note
• https://github.com/cilium/cilium/releases/tag/v1.13.4 · Note
• https://github.com/cilium/cilium/security/advisories/GHSA-r7wr-4w5q-55m6 · Note