CVE-2024-28249

Executive Summary

CVE-2024-28249 is a medium-severity vulnerability in Cilium, a cloud-native networking, observability, and security solution based on eBPF. The flaw affects clusters with IPsec encryption enabled and Layer 7 network policies configured. Under these conditions, IPsec-eligible traffic between a node's Envoy proxy and pods on other nodes, as well as traffic between a node's DNS proxy and pods on other nodes, is transmitted in cleartext (unencrypted). This bypasses the intended IPsec encryption, exposing sensitive data to potential interception on the network.

The vulnerability has a CVSS score of 6.1 (Medium) and a CVSS vector of AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating a high confidentiality impact with no integrity or availability impact. The attack vector is adjacent network, meaning an attacker must have access to the same network segment as the affected traffic. The EPSS score is 0.0%, suggesting low exploitation likelihood in the wild, but the risk is significant for environments handling sensitive data.

No public proof-of-concept (PoC) or exploit code is available at this time. The vulnerability is patched in Cilium versions 1.15.2, 1.14.8, and 1.13.13. There is no known workaround.

Supply Chain & Package Security

Cilium is distributed as a Go binary and container image. The vulnerability is in the core Cilium agent and operator components. Organizations using Cilium should verify their deployment version and update to the patched releases. The supply chain risk is moderate, as the flaw is in the application logic rather than a dependency.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Adjacent Network (A) – attacker must be on the same network segment.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): High (H) – complete loss of confidentiality for IPsec-eligible traffic.
• Integrity (I): None (N) – no integrity impact.
• Availability (A): None (N) – no availability impact.

Threat Level: Medium. The vulnerability requires adjacent network access, but if an attacker gains such access, they can intercept sensitive data that should be encrypted by IPsec.

Deep Dive & Mechanics

Cilium uses eBPF to implement networking, security, and observability. When IPsec is enabled, Cilium encrypts traffic between nodes using IPsec tunnels. Layer 7 (L7) network policies allow fine-grained control over application-layer traffic (e.g., HTTP, gRPC). To enforce L7 policies, Cilium uses Envoy proxies (for general L7) and a DNS proxy (for DNS traffic).

The vulnerability arises from a misconfiguration in the routing of traffic between these proxies and pods on other nodes. Specifically:

• Envoy Proxy: When a pod on node A sends traffic to a pod on node B that matches an L7 policy, the traffic is first redirected to the local Envoy proxy on node A. The Envoy proxy then forwards the traffic to the destination pod on node B. However, due to a bug, this forwarded traffic is not encrypted with IPsec, even though it should be.
• DNS Proxy: Similarly, DNS traffic that is intercepted by the Cilium DNS proxy and forwarded to a DNS server on another node is sent unencrypted.

The root cause is likely in the eBPF program or the Cilium agent's routing logic that fails to apply IPsec encryption to traffic originating from the proxy processes. This means that an attacker on the same network can sniff the unencrypted traffic, gaining access to sensitive data such as API requests, database queries, or DNS queries.

Vulnerable vs. Patched Code

The vulnerability is fixed in Cilium versions 1.15.2, 1.14.8, and 1.13.13. The patch likely involves changes to the eBPF programs or the Cilium agent's routing logic to ensure that traffic from Envoy and DNS proxies is correctly encrypted with IPsec when destined for other nodes.

Vulnerable Code (Conceptual):

// In Cilium agent, when forwarding traffic from proxy to remote pod:
// The eBPF program or routing table does not mark the packet for IPsec encryption.
// This results in cleartext transmission.

Patched Code (Conceptual):

// After patch, the eBPF program or routing table correctly marks packets from proxy
// processes with the IPsec encryption flag, ensuring they are encrypted before transmission.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Intercept unencrypted IPsec-eligible traffic between Cilium nodes.

Prerequisites:

• Access to the same network segment as the Cilium cluster (e.g., compromised host, rogue device on the same VLAN).
• Cilium cluster with IPsec enabled and L7 policies in use.

Steps:

1. Network Reconnaissance: Use tools like nmap or tcpdump to identify Cilium nodes and their IP addresses.
2. Packet Capture: Run a packet capture tool (e.g., tcpdump, Wireshark) on the network interface to capture traffic between nodes.
3. Filter for Unencrypted Traffic: Look for traffic that should be encrypted (e.g., HTTP, gRPC, DNS) but is sent in cleartext. This traffic will originate from the Envoy or DNS proxy IPs.
4. Extract Sensitive Data: Analyze the captured packets to extract sensitive information such as API keys, database credentials, or internal DNS queries.

Example tcpdump command:

tcpdump -i eth0 -w cilium_leak.pcap

Blue Team (Defender)

Objective: Detect and mitigate exploitation of CVE-2024-28249.

Steps:

1. Version Check: Verify Cilium version on all nodes. If version < 1.13.13, < 1.14.8, or < 1.15.2, the cluster is vulnerable.
2. Network Monitoring: Monitor for unencrypted traffic between nodes that should be encrypted. Use network monitoring tools to detect cleartext L7 traffic.
3. Anomaly Detection: Look for unexpected traffic patterns, such as traffic from Envoy or DNS proxy IPs that is not encrypted.
4. Patch Immediately: Upgrade Cilium to the patched version.
5. Incident Response: If exploitation is suspected, isolate affected nodes, review logs, and conduct forensic analysis.

Indicators of Compromise (IOCs)

• Network Traffic: Unencrypted IPsec-eligible traffic (e.g., HTTP, gRPC, DNS) between Cilium nodes, especially from Envoy or DNS proxy IPs.
• Logs: Cilium agent logs may show routing errors or missing IPsec encryption flags.
• Packet Capture: PCAP files containing cleartext L7 traffic that should be encrypted.

Detection Engineering

YARA Rule

rule CVE_2024_28249_Cilium_IPsec_Bypass {
    meta:
        description = "Detects Cilium IPsec bypass vulnerability indicators"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-28249"
    strings:
        $s1 = "cilium-agent" nocase
        $s2 = "ipsec" nocase
        $s3 = "envoy" nocase
        $s4 = "dns-proxy" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: Cilium IPsec Bypass Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-28249 by monitoring for unencrypted traffic from Cilium proxies.
author: Valters IT
date: 2024-10-27
logsource:
    category: network_flow
    product: zeek
detection:
    selection:
        service: "http" or "dns" or "grpc"
        src_ip: "10.0.0.0/8"  # Adjust to Cilium node IP range
        dst_ip: "10.0.0.0/8"  # Adjust to Cilium node IP range
        encrypted: false
    condition: selection
falsepositives:
    - Legitimate unencrypted traffic that is not IPsec-eligible
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28249 Cilium IPsec Bypass - Unencrypted L7 Traffic"; flow:to_server; content:"|0d 0a|"; http_method; content:"|0d 0a|"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Action:

• Upgrade Cilium to version 1.15.2, 1.14.8, or 1.13.13.

Workaround:

• No known workaround exists. The only solution is to apply the patch.

Long-Term Mitigation:

• Implement network segmentation to limit adjacent network access.
• Use network monitoring to detect unencrypted traffic.
• Regularly update Cilium and other components.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.