{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42488", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-08-02T14:13:04.618Z", "datePublished": "2024-08-15T20:36:29.463Z", "dateUpdated": "2024-08-19T19:23:37.503Z"}, "containers": {"cna": {"title": "Cilium agent's race condition may lead to policy bypass for Host Firewall policy", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw"}, {"name": "https://github.com/cilium/cilium/pull/33511", "tags": ["x_refsource_MISC"], "url": "https://github.com/cilium/cilium/pull/33511"}, {"name": "https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8", "tags": ["x_refsource_MISC"], "url": "https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8"}], "affected": [{"vendor": "cilium", "product": "cilium", "versions": [{"version": "< 1.14.14", "status": "affected"}, {"version": ">= 1.15.0, < 1.15.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-15T20:36:29.463Z"}, "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected."}], "source": {"advisory": "GHSA-q7w8-72mr-vpgw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-19T19:18:35.109669Z", "id": "CVE-2024-42488", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T19:23:37.503Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42488", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-19T19:18:35.109669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-19T19:23:31.662Z"}}], "cna": {"title": "Cilium agent's race condition may lead to policy bypass for Host Firewall policy", "source": {"advisory": "GHSA-q7w8-72mr-vpgw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "cilium", "product": "cilium", "versions": [{"status": "affected", "version": "< 1.14.14"}, {"status": "affected", "version": ">= 1.15.0, < 1.15.8"}]}], "references": [{"url": "https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw", "name": "https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cilium/cilium/pull/33511", "name": "https://github.com/cilium/cilium/pull/33511", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8", "name": "https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-15T20:36:29.463Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42488", "state": "PUBLISHED", "dateUpdated": "2024-08-19T19:23:37.503Z", "dateReserved": "2024-08-02T14:13:04.618Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-08-15T20:36:29.463Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BE0B7D1-49C5-4604-AE7D-4E809E169BE5", "versionEndExcluding": "1.14.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:cilium:cilium:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0C8F90D-07B3-4666-8C22-089A2DA27A03", "versionEndExcluding": "1.15.8", "versionStartIncluding": "1.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected."}, {"lang": "es", "value": "Cilium es una soluci\u00f3n de redes, observabilidad y seguridad con un plano de datos basado en eBPF. Antes de las versiones 1.14.14 y 1.15.8, una condici\u00f3n de ejecuci\u00f3n en el agente Cilium puede hacer que el agente ignore las etiquetas que deber\u00edan aplicarse a un nodo. Esto, a su vez, podr\u00eda provocar que las CiliumClusterwideNetworkPolicies destinadas a nodos con la etiqueta ignorada no se apliquen, lo que provocar\u00eda una omisi\u00f3n de pol\u00edticas. Este problema se solucion\u00f3 en Cilium v1.14.14 y v1.15.8. Como el problema subyacente depende de una condici\u00f3n de ejecuci\u00f3n, los usuarios que no pueden actualizar pueden reiniciar el agente Cilium en los nodos afectados hasta que se confirme que las pol\u00edticas afectadas funcionan como se esperaba."}], "id": "CVE-2024-42488", "lastModified": "2024-09-27T18:49:05.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-08-15T21:15:17.270", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/cilium/cilium/commit/aa44dd148a9be95e07782e4f990e61678ef0abf8"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/cilium/cilium/pull/33511"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/cilium/cilium/security/advisories/GHSA-q7w8-72mr-vpgw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}