Cilium up to 1.13.14/1.14.8/1.15.2 ESP Sequence Number inadequate encryption

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cilium up to 1.13.14/1.14.8/1.15.2. Affected by this issue is some unknown functionality of the component ESP Sequence Number Handler. The manipulation results in inadequate encryption. This vulnerability is identified as CVE-2024-28860. The attack can only be performed from the local network. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Cilium up to 1.13.14/1.14.8/1.15.2. Affected is an unknown functionality of the component ESP Sequence Number Handler. The manipulation with an unknown input leads to a inadequate encryption vulnerability. CWE is classifying the issue as CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. This is going to have an impact on confidentiality. CVE summarizes:

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key recovery, replay attacks by a man-in-the-middle attacker. These attacks are possible due to an ESP sequence number collision when multiple nodes are configured with the same key. Fixed versions of Cilium use unique keys for each IPsec tunnel established between nodes, resolving all of the above attacks. This vulnerability is fixed in 1.13.13, 1.14.9, and 1.15.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-28860 since 03/11/2024. The exploitability is told to be difficult. The attack can only be done within the local network. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 1.14.9 or 1.15.3 eliminates this vulnerability. Applying the patch 311fbce5280491cddceab178d83b06fa23688c72 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Cilium

Version

• 1.13.0
• 1.13.1
• 1.13.2
• 1.13.3
• 1.13.4
• 1.13.5
• 1.13.6
• 1.13.7
• 1.13.8
• 1.13.9
• 1.13.10
• 1.13.11
• 1.13.12
• 1.13.13
• 1.13.14
• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.14.4
• 1.14.5
• 1.14.6
• 1.14.7
• 1.14.8
• 1.15.0
• 1.15.1
• 1.15.2

License

• open-source

Website

• Product: https://github.com/cilium/cilium/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion