x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-41333

[GoVulnBot]

CVE-2023-41333 references github.com/cilium/cilium, which may be a Go module.

Description:
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace is able to affect traffic on an entire Cilium cluster, potentially bypassing policy enforcement in other namespaces. By using a crafted endpointSelector that uses the DoesNotExist operator on the reserved:init label, the attacker can create policies that bypass namespace restrictions and affect the entire Cilium cluster. This includes potentially allowing or denying all traffic. This attack requires API server access, as described in the Kubernetes API Server Attacker section of the Cilium Threat Model. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. As a workaround an admission webhook can be used to prevent the use of endpointSelectors that use the DoesNotExist operator on the reserved:init label in CiliumNetworkPolicies.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-41333
• JSON: https://github.com/CVEProject/cvelist/tree/8e23c01bc8ca16079613b67ffe67860eec01624b/2023/41xxx/CVE-2023-41333.json
• advisory: GHSA-4xp2-w642-7mcx
• fix: k8s: Restrict configuring reserved:init policy via CNP cilium/cilium#28007
• web: https://docs.cilium.io/en/stable/security/threat-model/#kubernetes-api-server-attacker
• Imported by: https://pkg.go.dev/github.com/cilium/cilium?tab=importedby

Cross references:

• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-c66w-hq56-4q97 #393 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29178 #457 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29179 #458 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-wc5v-r48v-g4vh #530 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-pfhr-pccp-hwmh #959 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-4hc4-pgfx-3mrx #1642 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-8fg8-jh2h-f2hc #1643 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-r5x6-w42p-jhpp #1644 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-29002 #1730 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-2h44-x2wx-49f4 #1785 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-34242 #1862 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/cilium/cilium
      vulnerable_at: 1.14.2
      packages:
        - package: cilium
description: |-
    Cilium is a networking, observability, and security solution with an eBPF-based
    dataplane. An attacker with the ability to create or modify CiliumNetworkPolicy
    objects in a particular namespace is able to affect traffic on an entire Cilium
    cluster, potentially bypassing policy enforcement in other namespaces. By using
    a crafted `endpointSelector` that uses the `DoesNotExist` operator on the
    `reserved:init` label, the attacker can create policies that bypass namespace
    restrictions and affect the entire Cilium cluster. This includes potentially
    allowing or denying all traffic. This attack requires API server access, as
    described in the Kubernetes API Server Attacker section of the Cilium Threat
    Model. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and
    1.12.14. As a workaround an admission webhook can be used to prevent the use of
    `endpointSelectors` that use the `DoesNotExist` operator on the `reserved:init`
    label in CiliumNetworkPolicies.
cves:
    - CVE-2023-41333
references:
    - advisory: https://github.com/cilium/cilium/security/advisories/GHSA-4xp2-w642-7mcx
    - fix: https://github.com/cilium/cilium/pull/28007
    - web: https://docs.cilium.io/en/stable/security/threat-model/#kubernetes-api-server-attacker

[jba]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/531705 mentions this issue: data/excluded: batch add 18 excluded reports

[jba]

Duplicate of #2080