CVE-2024-28860: 
Cilium vulnerability analysis and mitigation

Cilium, a networking, observability, and security solution with an eBPF-based dataplane, disclosed a vulnerability (CVE-2024-28860) affecting its IPsec transparent encryption feature. The vulnerability was discovered and disclosed on March 27, 2024, affecting versions prior to 1.13.13, 1.14.9, and 1.15.3. The issue impacts users who have enabled IPsec transparent encryption in their Cilium deployments (Cilium Docs, GitHub Advisory).

The vulnerability stems from ESP sequence number collisions when multiple nodes are configured with the same key in IPsec transparent encryption. This configuration flaw allows for cryptographic attacks that can compromise the encryption's effectiveness. The issue has been assigned a CVSS v3.1 base score of 8.0 (HIGH) with the vector string CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating adjacent network access requirements but no privileges or user interaction needed (GitHub Advisory).

The vulnerability exposes affected systems to multiple cryptographic attacks by a man-in-the-middle attacker, including chosen plaintext attacks, key recovery attacks, and replay attacks. These attacks can render the transparent encryption ineffective, potentially compromising the confidentiality and integrity of encrypted communications between Cilium-managed endpoints (GitHub Advisory).

The vulnerability requires an attacker to be in a man-in-the-middle position between nodes in the cluster. While the attack complexity is rated as high, no special privileges or user interaction is required to exploit the vulnerability once the attacker has achieved the necessary network position (GitHub Advisory).

The vulnerability has been fixed in Cilium versions 1.13.14, 1.14.9, and 1.15.3. The fix implements unique keys for each IPsec tunnel established between nodes. After upgrading, users must perform a key rotation following the updated instructions, ensuring that the IPsec Kubernetes secret contains a '+' sign. There are no workarounds available; users are strongly encouraged to upgrade to a patched version (GitHub Advisory, Cilium Docs).

The Cilium community worked collaboratively with members of Cure53 and Isovalent to prepare the mitigations. Notable contributions came from security researchers including Marsh Ray from Microsoft, who provided input and guidance on the fix (GitHub Advisory).