CVE-2024-42486
📋 TL;DR
A vulnerability in Cilium's GatewayAPI controller fails to properly propagate ReferenceGrant changes, allowing Gateway resources to retain access to secrets longer than intended or Routes to forward traffic to backends in other namespaces beyond their authorization. This affects Cilium deployments using Gateway API features on affected versions. Organizations running Cilium with Gateway API functionality are at risk.
💻 Affected Systems
- Cilium
📦 What is this software?
Cilium by Cilium
Cilium by Cilium
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to sensitive secrets across namespaces, potentially exposing credentials, certificates, or other confidential data to unauthorized Gateway resources, leading to data breaches or lateral movement.
Likely Case
Routes maintaining access to backend services in other namespaces after ReferenceGrant revocation, potentially violating namespace isolation and allowing unintended traffic flow between namespaces.
If Mitigated
Limited impact if proper network policies and RBAC controls are in place, but namespace isolation may still be compromised temporarily.
🎯 Exploit Status
Exploitation requires cluster access to modify ReferenceGrants and knowledge of Gateway API configurations. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Cilium v1.15.8 and v1.16.1
Vendor Advisory: https://github.com/cilium/cilium/security/advisories/GHSA-vwf8-q6fw-4wcm
Restart Required: Yes
Instructions:
1. Backup your Cilium configuration. 2. Upgrade Cilium to v1.15.8 (if on 1.15.x) or v1.16.1 (if on 1.16.x). 3. Restart Cilium components. 4. Verify Gateway API functionality post-upgrade.
🔧 Temporary Workarounds
Trigger ReferenceGrant Reconciliation
allModify any related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD to force reconciliation of ReferenceGrants
kubectl label <resource-type> <resource-name> trigger-reconciliation=true
🧯 If You Can't Patch
- Implement strict network policies to limit cross-namespace traffic
- Monitor and audit ReferenceGrant changes and Gateway API resource modifications
🔍 How to Verify
Check if Vulnerable:
Check Cilium version: kubectl get daemonset -n kube-system cilium -o jsonpath='{.spec.template.spec.containers[0].image}' | grep -E '1\.15\.([0-7]|$)|1\.16\.0'Check Version:
kubectl get daemonset -n kube-system cilium -o jsonpath='{.spec.template.spec.containers[0].image}'Verify Fix Applied:
Confirm version is 1.15.8 or higher (for 1.15.x) or 1.16.1 or higher (for 1.16.x) and test ReferenceGrant revocation functionality📡 Detection & Monitoring
Log Indicators:
- Unexpected cross-namespace traffic patterns
- Gateway resources accessing secrets after ReferenceGrant removal
Network Indicators:
- Traffic flowing between namespaces without active ReferenceGrants
SIEM Query:
source="cilium-logs" AND ("ReferenceGrant" OR "GatewayAPI") AND ("failed propagation" OR "stale access")