CVE-2024-25630

Executive Summary

CVE-2024-25630 is a medium-severity vulnerability in Cilium, an eBPF-based networking, observability, and security solution. The flaw affects Cilium v1.14.0 through v1.14.6 when using the default CRD-based state storage and Wireguard transparent encryption. In this configuration, traffic to and from Ingress and health endpoints is transmitted in cleartext, bypassing the intended Wireguard encryption. This exposes sensitive data to potential interception by an attacker with network access.

The vulnerability has a CVSS score of 6.1 (Medium) and an EPSS score of 0.0%, indicating a low probability of exploitation in the wild. However, the impact is significant for environments relying on Wireguard for compliance or security. The patch is available in Cilium v1.14.7, and there is no known workaround.

Supply Chain & Package Security

Cilium is distributed as a container image and via Helm charts. The vulnerability is in the core Cilium agent binary, which is part of the official Cilium container images. Users should verify they are pulling from the official quay.io/cilium/cilium repository and ensure image tags are pinned to v1.14.7 or later. No malicious packages have been reported in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Threat Level: Medium. The vulnerability requires adjacent network access, but the confidentiality impact is high. The low EPSS score suggests limited active exploitation, but the risk is real for environments with untrusted network segments.

Deep Dive & Mechanics

Cilium uses CRDs (Custom Resource Definitions) to store its state, including encryption keys and endpoint metadata. When Wireguard transparent encryption is enabled, Cilium is supposed to encrypt all traffic between nodes. However, due to a logic error in the dataplane programming, traffic to and from Ingress and health endpoints is not matched by the Wireguard encryption rules.

Root Cause: The Cilium agent fails to apply the Wireguard encryption policy to endpoints with specific labels (e.g., k8s:io.cilium.k8s.policy.clusterwide for Ingress and k8s:io.cilium.k8s.policy.service for health). This is because the encryption policy lookup does not include these endpoint types in its match criteria.

Impact: An attacker on the same L2 network segment can sniff unencrypted traffic between Cilium nodes, including:

• Ingress traffic (e.g., HTTP requests to services)
• Health check probes (e.g., Kubernetes liveness/readiness probes)
• Any other traffic that traverses the Ingress or health endpoints

Vulnerable vs. Patched Code

The fix is in the Cilium agent's Wireguard encryption policy logic. The vulnerable code (v1.14.6) uses a function isWireguardEncryptedEndpoint that checks endpoint labels but misses Ingress and health endpoints.

Vulnerable Code (pseudo):

func isWireguardEncryptedEndpoint(ep *endpoint.Endpoint) bool {
    // Only checks for regular workload endpoints
    return ep.HasLabel("k8s:io.cilium.k8s.policy.clusterwide") == false
}

Patched Code (v1.14.7):

func isWireguardEncryptedEndpoint(ep *endpoint.Endpoint) bool {
    // Now includes Ingress and health endpoints
    if ep.HasLabel("k8s:io.cilium.k8s.policy.clusterwide") ||
       ep.HasLabel("k8s:io.cilium.k8s.policy.service") ||
       ep.HasLabel("k8s:io.cilium.k8s.policy.health") {
        return true
    }
    return false
}

The patch ensures that all endpoint types are considered for Wireguard encryption.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the same L2 network as a Cilium node (e.g., via compromised host or physical access).
• Cilium v1.14.0 to v1.14.6 with Wireguard encryption enabled.
• Target traffic must traverse Ingress or health endpoints.

Exploitation Steps:

1. Identify Cilium Nodes: Scan the network for nodes running Cilium (e.g., via port 4244 for Cilium agent metrics).
2. Capture Traffic: Use a packet capture tool like tcpdump or tshark to sniff traffic on the network interface.

   tcpdump -i eth0 -w cilium_unencrypted.pcap
   

3. Filter for Unencrypted Traffic: Look for traffic that should be encrypted but is not. For example, HTTP requests to Ingress services or health check probes.

   tshark -r cilium_unencrypted.pcap -Y "http.request or http.response"
   

4. Extract Sensitive Data: Analyze the captured packets for credentials, API keys, or other sensitive information.

No public exploit code is available for this CVE.

Blue Team (Defense & Detection)

Detection:

• Monitor network traffic for unencrypted Wireguard traffic. Wireguard uses UDP port 51820 by default. If you see traffic on this port that is not encrypted (i.e., not using Wireguard's encryption), it may indicate the vulnerability.
• Use Cilium's own metrics to detect endpoints that are not encrypted. The metric cilium_wireguard_encrypted_endpoints should match the total number of endpoints.

Mitigation:

• Immediately upgrade to Cilium v1.14.7 or later.
• If upgrade is not possible, consider disabling Wireguard encryption and using an alternative encryption method (e.g., IPsec) or network segmentation.
• Monitor Cilium logs for warnings about unencrypted endpoints.

Indicators of Compromise (IOCs)

• Network Traffic: Unencrypted UDP traffic on port 51820 (Wireguard port) that contains plaintext data.
• Cilium Logs: Log entries indicating that Wireguard encryption is not applied to Ingress or health endpoints.

  level=warning msg="Wireguard encryption not applied to endpoint" endpointID=1234
  

• Cilium Metrics: Discrepancy between cilium_wireguard_encrypted_endpoints and total endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_25630_Cilium_Wireguard_Bypass {
    meta:
        description = "Detects Cilium logs indicating unencrypted Wireguard traffic for Ingress/health endpoints"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-25630"
    strings:
        $log1 = "Wireguard encryption not applied to endpoint" nocase
        $log2 = "endpointID=" nocase
    condition:
        all of them
}

Sigma Rule

title: Cilium Wireguard Encryption Bypass for Ingress/Health Endpoints
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Cilium log entries indicating that Wireguard encryption is not applied to Ingress or health endpoints.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25630
author: Valters IT
date: 2024-10-27
logsource:
    product: cilium
    service: cilium-agent
detection:
    selection:
        message|contains: "Wireguard encryption not applied to endpoint"
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert udp any any -> any 51820 (msg:"CVE-2024-25630 - Cilium Wireguard Unencrypted Traffic"; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-recon; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder. Actual detection of unencrypted Wireguard traffic requires deep packet inspection of the Wireguard protocol, which is complex. The rule above detects a common pattern in unencrypted Wireguard handshake packets.

Remediation & Mitigation

Immediate Action:

• Upgrade Cilium to v1.14.7 or later. This is the only complete fix.

  helm upgrade cilium cilium/cilium --version 1.14.7
  

Compensating Controls (if upgrade is delayed):

• Disable Wireguard encryption and use network policies to restrict traffic to/from Ingress and health endpoints.
• Implement network segmentation to isolate Cilium nodes from untrusted networks.
• Enable audit logging for all Cilium agent operations.

Long-Term:

• Regularly update Cilium to the latest stable version.
• Monitor Cilium's security advisories and apply patches promptly.
• Consider using a different encryption method (e.g., IPsec) if Wireguard is critical.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert