CVE-2024-47825
published 2024-10-21CVE-2024-47825: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and…
PriorityP354high8.7CVSS 3.1
AVNACHPRNUINSCCHIHAN
EPSS
0.40%
33.7th percentile
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cilium | cilium | — | — |
| cilium | cilium | — | — |
| cilium | cilium | >= 1.14.0 < 1.14.16 | 1.14.16 |
| cilium | cilium | >= 1.15.0 < 1.15.10 | 1.15.10 |
| github.com | cilium_cilium | >= 1.14.0 < 1.14.16 | 1.14.16 |
| github.com | cilium_cilium | >= 1.15.0 < 1.15.10 | 1.15.10 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
osv·2024-10-28
CVE-2024-47825 Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present in github.com/cilium/cilium
OSV
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present
osv·2024-10-21
CVE-2024-47825 [MEDIUM] Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present
### Impact
A policy rule denying a prefix that is broader than /32 may be ignored if there is
- A policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) **and**
- This narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`
Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.
As an example, given the below policies, traffic is allowed to 1.1.1.2, when it should be denied:
```
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: block-scary-range
spec:
endpointSelector: {}
egressDeny:
- toCIDRSet:
- cidr: 1.0.0.0/8
---
apiVersion: cilium.io/v2
kind: CiliumNetw
GHSA
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present
ghsa·2024-10-21
CVE-2024-47825 [MEDIUM] CWE-1038 Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present
Cilium's CIDR deny policies may not take effect when a more narrow CIDR allow is present
### Impact
A policy rule denying a prefix that is broader than /32 may be ignored if there is
- A policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) **and**
- This narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`
Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.
As an example, given the below policies, traffic is allowed to 1.1.1.2, when it should be denied:
```
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: block-scary-range
spec:
endpointSelector: {}
egressDeny:
- toCIDRSet:
- cidr: 1.0.0.0/8
---
apiVersion: cilium.io/v2
kind: CiliumNetw
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-10-21
Published