CVE-2024-28248: 
Cilium vulnerability analysis and mitigation

CVE-2024-28248 affects Cilium, a networking, observability, and security solution with an eBPF-based dataplane. The vulnerability was discovered in version 1.13.9 and affects versions prior to 1.13.13, 1.14.8, and 1.15.2. The issue was disclosed on March 18, 2024 (NVD, GitHub Advisory).

The vulnerability involves Cilium's HTTP policies not being consistently applied to all traffic within the scope of the policies. This leads to HTTP traffic being incorrectly and intermittently forwarded when it should be dropped. The issue has been assigned a CVSS v3.1 base score of 7.2 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity and no required privileges or user interaction (GitHub Advisory).

The vulnerability allows unauthorized access to HTTP traffic that should be blocked by policy, potentially leading to security policy bypass. This could result in unauthorized data access and potential integrity issues, as indicated by the Low impact ratings for both Confidentiality and Integrity in the CVSS score (GitHub Advisory).

The vulnerability is exploitable over the network with low attack complexity and requires no special privileges or user interaction. The CVSS metrics indicate that the attack vector is network-accessible (AV:N) with low complexity (AC:L), making it relatively straightforward to exploit (GitHub Advisory).

The vulnerability has been patched in Cilium versions 1.15.2, 1.14.8, and 1.13.13. There are no known workarounds for this issue, and affected users are strongly encouraged to upgrade to the patched versions. The Cilium community worked together with members of Isovalent to prepare these mitigations (GitHub Advisory).

The vulnerability was discovered and reported by @romikps, with special acknowledgment to @sayboras and @jrajahalme for preparing the fix. The Cilium community has actively collaborated with Isovalent members to address this security issue (GitHub Advisory).