CVE-2024-42486

Executive Summary

CVE-2024-42486 is a vulnerability in Cilium's GatewayAPI controller affecting versions 1.15.x prior to 1.15.8 and 1.16.x prior to 1.16.1. The flaw involves improper propagation of ReferenceGrant changes, which can lead to Gateway resources retaining access to secrets longer than intended, or Routes forwarding traffic to backends in other namespaces beyond the intended duration. This is a logic error in the controller's reconciliation loop, not a memory corruption or injection flaw. The CVSS score is 5.4 (Medium), with low impact on confidentiality and integrity, and no impact on availability. No public exploit code or proof-of-concept is available, and the EPSS score is 0.0%, indicating low exploitation likelihood. The vulnerability is patched in versions 1.15.8 and 1.16.1.

Supply Chain & Package Security

Cilium is distributed as a container image and via Helm charts. The vulnerability affects the GatewayAPI controller component, which is part of the Cilium binary. Users should verify their Cilium version and update to the patched releases. No malicious packages or compromised dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered medium due to the low impact on confidentiality and integrity, and the absence of availability impact. The attack complexity is low, and no privileges are required, but the vulnerability requires specific conditions (ReferenceGrant changes not being propagated) to be exploitable.

Deep Dive & Mechanics

The vulnerability resides in Cilium's GatewayAPI controller, which manages Gateway API resources such as Gateways, HTTPRoutes, GRPCRoutes, TCPRoutes, and ReferenceGrants. ReferenceGrants are used to allow cross-namespace references, such as a Gateway in one namespace referencing a Secret in another namespace, or a Route forwarding traffic to a backend in another namespace.

The issue is that when a ReferenceGrant is modified or deleted, the controller does not properly propagate these changes to the affected Gateway and Route resources. This means that if a ReferenceGrant is revoked (e.g., a Secret access is removed), the Gateway may still retain access to that Secret, and Routes may continue to forward traffic to backends in other namespaces. This can lead to unauthorized access to secrets or unintended traffic routing.

The root cause is a missing or incomplete reconciliation trigger for ReferenceGrant changes. The controller only reconciles when the Gateway or Route resources themselves change, not when the ReferenceGrant changes. The workaround involves making a trivial modification to any related Gateway/Route CRD (e.g., adding a label) to force a full reconciliation.

Vulnerable vs. Patched Code

The vulnerable code is in the GatewayAPI controller's reconciliation logic. The patched code adds a watch on ReferenceGrant resources and triggers reconciliation of affected Gateways and Routes when a ReferenceGrant changes.

Vulnerable Code (Conceptual):

// Only watches Gateway and Route resources
func (r *gatewayReconciler) SetupWithManager(mgr ctrl.Manager) {
    ctrl.NewControllerManagedBy(mgr).
        For(&gatewayv1.Gateway{}).
        Owns(&gatewayv1.HTTPRoute{}).
        Complete(r)
}

Patched Code (Conceptual):

// Adds watch on ReferenceGrant resources
func (r *gatewayReconciler) SetupWithManager(mgr ctrl.Manager) {
    ctrl.NewControllerManagedBy(mgr).
        For(&gatewayv1.Gateway{}).
        Owns(&gatewayv1.HTTPRoute{}).
        Watches(&source.Kind{Type: &gatewayv1.ReferenceGrant{}}, 
            handler.EnqueueRequestsFromMapFunc(r.mapReferenceGrantToGateways)).
        Complete(r)
}

func (r *gatewayReconciler) mapReferenceGrantToGateways(ctx context.Context, obj client.Object) []reconcile.Request {
    // Map ReferenceGrant changes to affected Gateways and Routes
    // ...
}

The patch ensures that any change to a ReferenceGrant triggers reconciliation of the associated Gateway and Route resources, thereby enforcing the intended access controls.

Exploitation & Lab Setup

Red Team

No public exploit code is available. To simulate the vulnerability in a lab environment:

1. Setup: Deploy Cilium v1.15.7 with GatewayAPI enabled.
2. Create Resources: Create a Gateway in namespace ns1 that references a Secret in namespace ns2 via a ReferenceGrant.
3. Verify Access: Ensure the Gateway can access the Secret.
4. Revoke ReferenceGrant: Delete or modify the ReferenceGrant to remove the cross-namespace permission.
5. Exploit: Observe that the Gateway still has access to the Secret (e.g., by checking the controller logs or attempting to use the Secret). This demonstrates the vulnerability.

Lab Setup Commands:

# Install Cilium v1.15.7
helm install cilium cilium/cilium --version 1.15.7 --namespace kube-system

# Create namespaces
kubectl create ns ns1
kubectl create ns ns2

# Create Secret in ns2
kubectl -n ns2 create secret generic my-secret --from-literal=key=value

# Create ReferenceGrant in ns2 allowing ns1 to access secrets
cat <<EOF | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1
kind: ReferenceGrant
metadata:
  name: allow-ns1
  namespace: ns2
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: Gateway
    namespace: ns1
  to:
  - group: ""
    kind: Secret
EOF

# Create Gateway in ns1 referencing the Secret
cat <<EOF | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-gateway
  namespace: ns1
spec:
  gatewayClassName: cilium
  listeners:
  - name: https
    port: 443
    protocol: HTTPS
    tls:
      certificateRefs:
      - name: my-secret
        namespace: ns2
EOF

# Revoke ReferenceGrant
kubectl delete referencegrant -n ns2 allow-ns1

# Check if Gateway still has access (e.g., via controller logs)
kubectl logs -n kube-system -l k8s-app=cilium-operator | grep -i "secret"

Blue Team

To detect exploitation attempts:

1. Monitor Cilium Controller Logs: Look for anomalies in reconciliation events, especially for Gateway and Route resources that should have been updated after ReferenceGrant changes.
2. Audit ReferenceGrant Changes: Enable Kubernetes audit logging for ReferenceGrant resources and monitor for unexpected deletions or modifications.
3. Check Secret Access: Periodically verify that Gateways only have access to Secrets that are explicitly allowed by current ReferenceGrants.

Detection Commands:

# Check for stale secret references in Gateway resources
kubectl get gateway -A -o json | jq '.items[] | select(.spec.listeners[].tls.certificateRefs[]?.namespace != null) | {name: .metadata.name, namespace: .metadata.namespace, secretRefs: [.spec.listeners[].tls.certificateRefs[]]}'

# Monitor Cilium operator logs for reconciliation issues
kubectl logs -n kube-system -l k8s-app=cilium-operator --tail=100 | grep -E "(reconcile|ReferenceGrant|secret)"

Indicators of Compromise (IOCs)

• Log Entries: Cilium operator logs showing repeated reconciliation of Gateway/Route resources without corresponding ReferenceGrant changes.
• Network Traffic: Unexpected cross-namespace traffic from a Gateway to a backend that should have been blocked by a revoked ReferenceGrant.
• Kubernetes Events: Missing or delayed reconciliation events for Gateway/Route resources after ReferenceGrant modifications.
• API Server Audit Logs: Unauthorized access attempts to Secrets in other namespaces via Gateway resources.

Detection Engineering

YARA Rule

rule CVE_2024_42486_Cilium_ReferenceGrant {
    meta:
        description = "Detects Cilium GatewayAPI controller logs indicating ReferenceGrant propagation failure"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-42486"
        severity = "medium"
    strings:
        $s1 = "ReferenceGrant" nocase
        $s2 = "reconcile" nocase
        $s3 = "secret" nocase
        $s4 = "gateway" nocase
        $s5 = "propagation" nocase
    condition:
        all of ($s1, $s2, $s3, $s4) or ($s1 and $s5)
}

Sigma Rule

title: Cilium ReferenceGrant Propagation Failure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Cilium GatewayAPI controller logs indicating ReferenceGrant changes not propagated
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-42486
logsource:
    product: kubernetes
    service: cilium-operator
detection:
    selection:
        - "ReferenceGrant"
        - "reconcile"
        - "secret"
        - "gateway"
    condition: selection
falsepositives:
    - Legitimate reconciliation during normal operations
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-42486 Cilium ReferenceGrant Propagation Failure"; flow:to_server,established; content:"ReferenceGrant"; nocase; content:"reconcile"; nocase; content:"secret"; nocase; content:"gateway"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Cilium to v1.15.8 or v1.16.1 (or later) as soon as possible.
2. Workaround: If patching is not immediately possible, any modification to a related Gateway/HTTPRoute/GRPCRoute/TCPRoute CRD (e.g., adding a label) will trigger a reconciliation of ReferenceGrants. This can be done manually or via a cron job.

Long-Term Mitigations:

1. Network Policies: Implement Kubernetes NetworkPolicies to restrict cross-namespace traffic as a defense-in-depth measure.
2. Audit Logging: Enable Kubernetes audit logging for all Gateway API resources and monitor for anomalies.
3. Regular Updates: Keep Cilium and all Kubernetes components up to date with the latest security patches.
4. Least Privilege: Ensure that ReferenceGrants are granted only when necessary and are regularly reviewed.

Verification Steps:

# Verify Cilium version
kubectl -n kube-system get pods -l k8s-app=cilium -o jsonpath='{.items[0].spec.containers[0].image}'

# Check for patched version
kubectl -n kube-system get pods -l k8s-app=cilium-operator -o jsonpath='{.items[0].spec.containers[0].image}'

Valters IT
DevSecOps & Cyber Threat Intelligence Expert