Cilium v1.19.3 Security Advisory: BPF Panic, Memory Leak, Policy Fix

Vulnerability Overview In Cilium v1.19.3, several security-related vulnerabilities and fixes were addressed, primarily involving the following areas: 1. Performance issues in L7 policy proxy redirection handling: - Fixed performance issues in the handling of L7 policy proxy redirection. 2. Client faults in KVStore identity mode: - Fixed an issue where Cilium clients would fail to initialize when using the KVStore identity mode with etcd as the backend for K8s services. 3. Ignored IPv6 addresses in NodePort bindings: - Fixed an issue where local IPv6 addresses were being ignored in NodePort bindings. 4. Duplicate IPv6 PodCIDRs in dual-stack cluster-wide IPAM: - Fixed an issue in dual-stack cluster-wide IPAM where the operator running with pre-existing duplicate IPv6 PodCIDRs could cause the IPv4 PodCIDR of affected nodes to be incorrectly released and reallocated to another node. 5. Incomplete policy updates after Endpoint deletion: - Fixed an issue where policy updates were not completed after Endpoint deletion. 6. Memory leak in Hubble: - Fixed a memory leak in Hubble caused by the log coloring feature, even when coloring was disabled. 7. Panic in BPF maps: - Fixed a panic caused by not checking the certificate validator before cleaning up BPF maps. 8. IPv4 connectivity issues in WireGuard: - Fixed an issue where IPv4 connectivity problems were not handled correctly when unreachable address selection was used for peer endpoints. Impact Scope L7 policy proxy redirection handling: Affects all users using L7 policy proxies. KVStore identity mode: Affects users using the KVStore identity mode. NodePort bindings: Affects users using NodePort bindings. Dual-stack cluster-wide IPAM: Affects users using dual-stack cluster-wide IPAM. Policy updates after Endpoint deletion: Affects all users managing Endpoints. Memory leak in Hubble: Affects users using Hubble for logging. Panic in BPF maps: Affects users using BPF maps. IPv4 connectivity issues in WireGuard: Affects users using WireGuard. Remediation L7 policy proxy redirection handling: Fixed via Backport PR #44828 and Upstream PR #44613. KVStore identity mode: Fixed via Backport PR #44828 and Upstream PR #44653. NodePort bindings: Fixed via Backport PR #44974 and Upstream PR #44703. Dual-stack cluster-wide IPAM: Fixed via Backport PR #44828 and Upstream PR #44832. Policy updates after Endpoint deletion: Fixed via Backport PR #44816 and Upstream PR #44754. Memory leak in Hubble: Fixed via Backport PR #44828 and Upstream PR #44119. Panic in BPF maps: Fixed via Backport PR #44974 and Upstream PR #44971. IPv4 connectivity issues in WireGuard: Fixed via Backport PR #45247 and Upstream PR #44629. POC Code or Exploit Code No specific POC code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Cilium v1.19.3 Security Advisory: BPF Panic, Memory Leak, Policy Fix

More from this source