CVE-2020-13597 in Calico
Summary
by MITRE
Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2020
This vulnerability affects containerized environments utilizing Calico networking solutions where IPv6 functionality is enabled but not actively used. The flaw exists in Calico versions 3.14.0 and earlier, as well as Calico Enterprise versions 2.8.2 and earlier, creating a significant security risk for Kubernetes clusters. When IPv6 is enabled on nodes running these vulnerable versions, the system defaults to accepting route advertisements from any source, which provides an attack vector for privilege-escalated adversaries. The vulnerability stems from insufficient network configuration controls that fail to properly validate or restrict IPv6 routing information exchange, allowing malicious actors to exploit this misconfiguration.
The technical implementation of this vulnerability relies on the default behavior of Linux kernel networking stack when IPv6 is enabled. Specifically, when nodes accept route advertisements without proper validation mechanisms, a compromised pod with sufficient privileges can manipulate the IPv6 routing table to redirect network traffic. This occurs because the node's IPv6 forwarding behavior is not properly restricted, allowing the attacker to inject malicious routes that can capture or redirect traffic intended for other network destinations. The attack leverages the principle of least privilege violation by enabling an attacker to effectively perform man-in-the-middle operations on network traffic originating from or destined to the compromised node.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables active traffic redirection capabilities that can result in complete network compromise. An attacker with access to a privileged pod can establish routing entries that capture all or partial network traffic, potentially exposing sensitive data, credentials, or system communications. This vulnerability is particularly dangerous in multi-tenant environments or when clusters handle confidential information, as it can allow attackers to intercept communications between services, applications, or even between different network segments. The risk is amplified when considering that the vulnerability does not require network-level privileges to exploit, as the compromised pod only needs sufficient container privileges to manipulate network interfaces.
Mitigation strategies should focus on disabling unused IPv6 functionality when it is not required for cluster operations, as this eliminates the attack surface entirely. Organizations should implement proper network segmentation and routing controls that validate route advertisements before accepting them, implementing mechanisms such as route filtering or prefix validation. Configuration management should enforce that IPv6 routing is properly restricted through kernel parameters or network policy enforcement, preventing the acceptance of unauthorized route advertisements. Additionally, implementing strict pod security policies that limit network capabilities and privilege escalation opportunities can reduce the impact of potential exploitation. This vulnerability aligns with CWE-284 (Improper Access Control) and ATT&CK technique T1071.004 (Application Layer Protocol: DNS) when considering the traffic interception capabilities, though the primary vector involves network layer manipulation rather than application layer attacks.