Cilium up to 1.14.7/1.15.1 WireGuard missing encryption

Summaryinfo

A vulnerability was found in Cilium up to 1.14.7/1.15.1 and classified as problematic. This affects an unknown part of the component WireGuard. The manipulation results in missing encryption. This vulnerability is identified as CVE-2024-28250. The attack can only be performed from the local network. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cilium up to 1.14.7/1.15.1. It has been classified as problematic. Affected is an unknown code of the component WireGuard. The manipulation with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. CVE summarizes:

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent between a node's Envoy proxy and pods on other nodes is sent unencrypted and Wireguard-eligible traffic that is sent between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.14.8 and 1.15.2 in in native routing mode (`routingMode=native`) and in Cilium 1.14.4 in tunneling mode (`routingMode=tunnel`). Not that in tunneling mode, `encryption.wireguard.encapsulate` must be set to `true`. There is no known workaround for this issue.

The advisory is available at github.com. This vulnerability is traded as CVE-2024-28250 since 03/07/2024. The exploitability is told to be difficult. The attack needs to be initiated within the local network. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

Upgrading to version 1.14.8 or 1.15.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Cilium

Version

• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.14.4
• 1.14.5
• 1.14.6
• 1.14.7
• 1.15.0
• 1.15.1

Website

• Product: https://github.com/cilium/cilium/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion