PT-2024-29985 · Cilium · Cilium

Skmatti · Published 2024-08-15 · Updated 2024-09-27 · CVE-2024-42488

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cilium versions prior to 1.14.14 Cilium versions 1.15.0 through 1.15.7

Description A race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node, leading to policy bypass. This could cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply.

Recommendations For Cilium versions prior to 1.14.14, update to version 1.14.14 or later. For Cilium versions 1.15.0 through 1.15.7, update to version 1.15.8 or later. As a temporary workaround, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BIT-CILIUM-2024-42488

BIT-CILIUM-OPERATOR-2024-42488

BIT-HUBBLE-RELAY-2024-42488

CVE-2024-42488

GHSA-Q7W8-72MR-VPGW

GO-2024-3072

Affected Products

Cilium

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42488.json · Exploit
• https://github.com/cilium/cilium/pull/33511 · Patch
• https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8 · Patch
• https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw · Patch
• https://osv.dev/vulnerability/GO-2024-3072 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-operator-2024-42488 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q7w8-72mr-vpgw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42488 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42488 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-cilium-2024-42488 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hubble-relay-2024-42488 · Vendor Advisory
• https://github.com/cilium/cilium · Note
• https://github.com/cilium/cilium/commit/7877db09b3f34d3081a1d66459b8fa6603dc3d30 · Note
• https://github.com/cilium/cilium/commit/f81a1ee0cfdec928980db8640def984b2eeaa134 · Note
• https://t.me/cvedetector/3292 · Telegram Post