GHSA-c66w-hq56-4q97: 
vulnerability analysis and mitigation

A low severity vulnerability (GHSA-c66w-hq56-4q97) was discovered in Cilium affecting versions 1.7.8-1.7.14, 1.8.3-1.8.7, and 1.9.0-1.9.4. The vulnerability allows ICMP Echo Requests to bypass network policies under specific conditions, potentially compromising network security controls (GitHub Advisory).

The vulnerability specifically affects ICMP Echo Request handling in Cilium's network policy enforcement. It occurs when network policies are configured to disallow access from an actor to an endpoint while allowing access from the endpoint to the actor without specifying protocol or port. The bypass happens when an endpoint sends an ICMP Echo Request to an actor with a specific ICMP identifier X, and the actor responds with an Echo Request using the same identifier before Cilium's conntrack GC removes the initial conntrack entry (GitHub Advisory).

The vulnerability only affects ICMP Echo Request traffic and does not impact UDP or TCP traffic. When successfully exploited, it allows an actor (pod, cluster host, or remote host) to bypass network policies that should prevent access to specific endpoints (GitHub Advisory).

The vulnerability has been patched in Cilium versions 1.7.15, 1.8.8, and 1.9.5. Users are advised to upgrade to these patched versions to prevent potential network policy bypasses (GitHub Advisory).