CVE-2024-42488: 
Cilium vulnerability analysis and mitigation

A race condition vulnerability (CVE-2024-42488) was discovered in Cilium, a networking, observability, and security solution with an eBPF-based dataplane. The vulnerability affects versions prior to 1.14.14 and versions 1.15.0 through 1.15.7. The issue was disclosed on August 15, 2024, and has been patched in Cilium versions 1.14.14 and 1.15.8 (GitHub Advisory).

The vulnerability stems from a race condition in the Cilium agent that can cause the agent to ignore labels that should be applied to a node. The issue occurs during agent startup where k8s node label updates are rejected indefinitely by the host endpoint. The current endpoint label update logic rejects a request if any of the labels on the old node are not present in the endpoint manager state. For host endpoints, the k8s node label add/update events may be missed if the k8s node watcher initializes before the host endpoint is created. The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N (GitHub Advisory).

The vulnerability can lead to CiliumClusterwideNetworkPolicies intended for nodes with the ignored label not being applied, resulting in a policy bypass. This could potentially compromise the security posture of affected systems by allowing traffic that should have been blocked by the network policies (GitHub Advisory).

The vulnerability requires high attack complexity but can be exploited remotely without requiring privileges or user interaction. The race condition nature of the vulnerability means exploitation depends on specific timing conditions during the Cilium agent startup process (GitHub Advisory).

The issue has been patched in Cilium versions 1.14.14 and 1.15.8. For users unable to upgrade immediately, a temporary workaround is available: restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected. This workaround is effective because the issue depends on a race condition that may not occur after a restart (GitHub Advisory).

The Cilium community worked collaboratively with members of Google and Isovalent to prepare the mitigations. Special acknowledgment was given to contributor skmatti for raising and resolving this issue (GitHub Advisory).