x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2023-27593

[GoVulnBot]

CVE-2023-27593 references github.com/cilium/cilium, which may be a Go module.

Description:
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with access to a Cilium agent pod can write to /opt/cni/bin due to a hostPath mount of that directory in the agent pod. By replacing the CNI binary with their own malicious binary and waiting for the creation of a new pod on the node, the attacker can gain access to the underlying node. The issue has been fixed and the fix is available on versions 1.11.15, 1.12.8, and 1.13.1. Some workarounds are available. Kubernetes RBAC should be used to deny users and service accounts exec access to Cilium agent pods. In cases where a user requires exec access to Cilium agent pods, but should not have access to the underlying node, no workaround is possible.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-27593
• JSON: https://github.com/CVEProject/cvelist/tree/444a3559357cd120a53a4c66b1be706a010a0057/2023/27xxx/CVE-2023-27593.json
• advisory: GHSA-4hc4-pgfx-3mrx
• fix: agent: install CNI plugin binary in an InitContainer cilium/cilium#24075
• web: https://github.com/cilium/cilium/releases/tag/v1.11.15
• web: https://github.com/cilium/cilium/releases/tag/v1.12.8
• web: https://github.com/cilium/cilium/releases/tag/v1.13.1
• web: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
• Imported by: https://pkg.go.dev/github.com/cilium/cilium?tab=importedby

Cross references:

• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-c66w-hq56-4q97 #393 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29178 #457 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: CVE-2022-29179 #458 EFFECTIVELY_PRIVATE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-wc5v-r48v-g4vh #530 NOT_GO_CODE
• Module github.com/cilium/cilium appears in issue x/vulndb: potential Go vuln in github.com/cilium/cilium: GHSA-pfhr-pccp-hwmh #959 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/cilium/cilium
    packages:
      - package: cilium
description: |
    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.11.15, 1.12.8, and 1.13.1, an attacker with access to a Cilium agent pod can write to `/opt/cni/bin` due to a `hostPath` mount of that directory in the agent pod. By replacing the CNI binary with their own malicious binary and waiting for the creation of a new pod on the node, the attacker can gain access to the underlying node. The issue has been fixed and the fix is available on versions 1.11.15, 1.12.8, and 1.13.1. Some workarounds are available. Kubernetes RBAC should be used to deny users and service accounts `exec` access to Cilium agent pods. In cases where a user requires `exec` access to Cilium agent pods, but should not have access to the underlying node, no workaround is possible.
cves:
  - CVE-2023-27593
references:
  - advisory: https://github.com/cilium/cilium/security/advisories/GHSA-4hc4-pgfx-3mrx
  - fix: https://github.com/cilium/cilium/pull/24075
  - web: https://github.com/cilium/cilium/releases/tag/v1.11.15
  - web: https://github.com/cilium/cilium/releases/tag/v1.12.8
  - web: https://github.com/cilium/cilium/releases/tag/v1.13.1
  - web: https://kubernetes.io/docs/reference/access-authn-authz/rbac/

[jba]

Duplicate of #1642