CVE-2024-28248

Executive Summary

CVE-2024-28248 is a high-severity vulnerability in Cilium, an eBPF-based networking, observability, and security solution. The flaw affects HTTP policy enforcement, causing intermittent bypasses where HTTP traffic that should be dropped is incorrectly forwarded. This can lead to unauthorized access to protected services, data exfiltration, or lateral movement within a Kubernetes cluster. The vulnerability impacts Cilium versions 1.13.9 through 1.13.12, 1.14.0 through 1.14.7, and 1.15.0 through 1.15.1. Patches are available in versions 1.13.13, 1.14.8, and 1.15.2. No known workarounds exist, making patching critical.

Supply Chain & Package Security

Cilium is distributed as a container image and via Helm charts. Organizations using Cilium as a CNI plugin should verify their deployment version and update immediately. The vulnerability is in the core dataplane code, not in a package manager (e.g., npm, PyPI), but the supply chain risk is high due to the potential for compromised clusters.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability allows an unauthenticated attacker to bypass HTTP policies, potentially accessing restricted endpoints. While each impact is rated Low, the combination and ease of exploitation elevate the overall severity to High.

Deep Dive & Mechanics

The vulnerability stems from a race condition or state inconsistency in Cilium's eBPF-based HTTP policy enforcement. When HTTP policies are applied to network traffic, the eBPF programs that inspect and filter HTTP requests may fail to consistently match all packets in a flow. This can occur due to:

• Incorrect BPF map lookups: The eBPF maps storing policy rules may not be atomically updated, leading to transient states where rules are missing.
• Flow tracking issues: Cilium's connection tracking may incorrectly associate HTTP requests with the wrong policy or no policy at all.
• Packet reordering: In high-throughput environments, packets may arrive out of order, causing the eBPF program to miss policy checks.

The result is that some HTTP requests that should be dropped (e.g., requests to /admin from an unauthorized source) are forwarded to the backend service. This is intermittent, making it difficult to detect without active monitoring.

Vulnerable vs. Patched Code

The fix involves correcting the eBPF program logic to ensure atomic policy updates and proper flow tracking. Below is a simplified representation:

Vulnerable (pseudo-code):

// eBPF program for HTTP policy
int http_policy(struct __sk_buff *skb) {
    struct policy_entry *entry = bpf_map_lookup_elem(&policy_map, &key);
    if (entry && entry->action == DROP) {
        return TC_ACT_SHOT;
    }
    return TC_ACT_OK;
}

The issue: The map lookup may return stale or incomplete data due to race conditions.

Patched (pseudo-code):

int http_policy(struct __sk_buff *skb) {
    struct policy_entry *entry = bpf_map_lookup_elem(&policy_map, &key);
    if (entry) {
        // Use atomic read to ensure consistency
        __sync_synchronize();
        if (entry->action == DROP) {
            return TC_ACT_SHOT;
        }
    }
    return TC_ACT_OK;
}

The patch adds memory barriers and ensures atomic reads of policy entries.

Exploitation & Lab Setup

Red Team

To simulate exploitation, set up a Cilium cluster with a vulnerable version (e.g., 1.14.0) and configure an HTTP policy that drops traffic to a specific path (e.g., /secret). Then, send repeated HTTP requests to that path from an unauthorized source. Due to the intermittent nature, some requests will be forwarded.

Lab Setup:

1. Deploy a Kubernetes cluster with Cilium 1.14.0.
2. Create a backend service (e.g., nginx) and a CiliumNetworkPolicy that drops HTTP GET requests to /secret.
3. Use a tool like curl or wrk to send many requests:

   for i in {1..1000}; do curl -s -o /dev/null -w "%{http_code}\n" http://<service>/secret; done
   

4. Observe that some requests return 200 OK instead of 403 Forbidden.

Blue Team

To detect exploitation attempts:

• Monitor Cilium agent logs for policy enforcement errors.
• Use network flow logs to identify unexpected access to protected endpoints.
• Deploy eBPF-based monitoring tools (e.g., Falco) to alert on policy bypass events.

Indicators of Compromise (IOCs)

• Network: HTTP requests to protected endpoints that should be blocked but return 200 OK.
• Logs: Cilium agent logs showing policy enforcement error or unexpected packet forwarded.
• Metrics: Spike in allowed traffic to restricted paths in Cilium's Hubble metrics.

Detection Engineering

YARA Rule

rule CVE_2024_28248_Cilium_HTTP_Bypass {
    meta:
        description = "Detects Cilium HTTP policy bypass indicators"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28248"
    strings:
        $s1 = "policy enforcement error" nocase
        $s2 = "unexpected packet forwarded" nocase
        $s3 = "HTTP policy bypass" nocase
    condition:
        any of them
}

Sigma Rule

title: Cilium HTTP Policy Bypass Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Cilium HTTP policy bypass attempts
author: Valters IT
date: 2025/04/10
logsource:
    product: cilium
    service: agent
detection:
    selection:
        - "policy enforcement error"
        - "unexpected packet forwarded"
    condition: selection
falsepositives:
    - Legitimate policy updates
level: high

Suricata Rule

alert http any any -> any any (msg:"Cilium HTTP Policy Bypass Attempt"; flow:to_server; content:"/secret"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Cilium to version 1.15.2, 1.14.8, or 1.13.13.
2. Workaround: None available. Patching is mandatory.
3. Compensating Controls:
   • Implement network segmentation to limit exposure.
   • Use Web Application Firewalls (WAF) to enforce HTTP policies at the edge.
   • Enable Hubble to monitor for anomalous traffic patterns.
4. Verification: After patching, test HTTP policy enforcement using the lab setup described above.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert