CVE-2025-23028

Executive Summary

CVE-2025-23028 is a denial of service (DoS) vulnerability affecting Cilium, an eBPF-based networking, observability, and security solution for Kubernetes. The flaw resides in the DNS proxy component, which is used to enforce DNS-based network policies. An attacker outside the cluster can send a crafted DNS response to a workload, causing the Cilium agent to crash. This disrupts DNS-based policy enforcement and prevents configuration changes from being applied until the agent restarts. The vulnerability has a CVSS score of 5.3 (Medium) and affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. Patches are available in versions 1.14.18, 1.15.12, and 1.16.5. No known exploits or public proof-of-concept code exist at this time.

Supply Chain & Package Security

Cilium is distributed as a container image and via Helm charts. The vulnerability is introduced in the Cilium agent binary, which is part of the official Cilium container images. Users should verify the integrity of their Cilium images by checking the image digest and signature. The fix is included in the following image tags:

• v1.14.18
• v1.15.12
• v1.16.5

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N) – The attacker can send a crafted DNS response from outside the cluster.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability affects only the Cilium agent.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) – The agent crashes, but traffic continues to pass for non-DNS-based policies.

Deep Dive & Mechanics

The vulnerability is triggered when the Cilium agent, acting as a DNS proxy, processes a malicious DNS response. The agent parses DNS responses to extract IP addresses for policy enforcement. A crafted response can cause a parsing error that leads to a nil pointer dereference or memory corruption, crashing the agent process.

Affected Component: Cilium agent (cilium-agent) – DNS proxy module.

Root Cause: Improper validation of DNS response fields, specifically in the handling of DNS resource records (RRs). An attacker can craft a response with malformed RDATA or unexpected record types that the agent does not handle gracefully.

Attack Scenario:

1. An attacker outside the Kubernetes cluster sends a DNS query to a workload that is configured to use Cilium’s DNS proxy.
2. The attacker responds with a crafted DNS response containing malformed resource records.
3. The Cilium agent parses the response and crashes due to a memory safety issue.
4. The agent restarts (if configured with a restart policy), but during the crash, DNS-based policies are not enforced, and configuration changes are not applied.

Impact:

• For workloads with DNS-based policies, new connections relying on DNS resolution are disrupted.
• Existing connections continue to operate.
• Configuration changes (e.g., policy updates) are not applied until the agent restarts.

Vulnerable vs. Patched Code

The fix involves adding input validation for DNS response fields. The vulnerable code likely lacked bounds checking or null pointer checks when parsing DNS resource records.

Vulnerable Code (Conceptual):

func parseDNSResponse(data []byte) *DNSResponse {
    resp := &DNSResponse{}
    // No validation of data length or record structure
    resp.Answers = parseResourceRecords(data[12:])
    return resp
}

func parseResourceRecords(data []byte) []ResourceRecord {
    var records []ResourceRecord
    for len(data) > 0 {
        rec := ResourceRecord{}
        rec.Type = binary.BigEndian.Uint16(data[0:2])
        rec.Class = binary.BigEndian.Uint16(data[2:4])
        rec.TTL = binary.BigEndian.Uint32(data[4:8])
        rdlength := binary.BigEndian.Uint16(data[8:10])
        // No check if rdlength exceeds remaining data
        rec.RDATA = data[10 : 10+rdlength]
        records = append(records, rec)
        data = data[10+rdlength:]
    }
    return records
}

Patched Code (Conceptual):

func parseDNSResponse(data []byte) (*DNSResponse, error) {
    if len(data) < 12 {
        return nil, fmt.Errorf("DNS response too short")
    }
    resp := &DNSResponse{}
    var err error
    resp.Answers, err = parseResourceRecords(data[12:])
    if err != nil {
        return nil, err
    }
    return resp, nil
}

func parseResourceRecords(data []byte) ([]ResourceRecord, error) {
    var records []ResourceRecord
    for len(data) > 0 {
        if len(data) < 10 {
            return nil, fmt.Errorf("resource record too short")
        }
        rec := ResourceRecord{}
        rec.Type = binary.BigEndian.Uint16(data[0:2])
        rec.Class = binary.BigEndian.Uint16(data[2:4])
        rec.TTL = binary.BigEndian.Uint32(data[4:8])
        rdlength := binary.BigEndian.Uint16(data[8:10])
        if int(rdlength) > len(data)-10 {
            return nil, fmt.Errorf("RDATA length exceeds remaining data")
        }
        rec.RDATA = make([]byte, rdlength)
        copy(rec.RDATA, data[10:10+rdlength])
        records = append(records, rec)
        data = data[10+rdlength:]
    }
    return records, nil
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Kubernetes cluster with Cilium configured as a DNS proxy.
• Ability to send DNS responses to a workload (e.g., by spoofing DNS or using a man-in-the-middle position).

Exploitation Steps:

1. Identify a workload that uses Cilium’s DNS proxy (e.g., a pod with DNS policy).
2. Send a DNS query to the workload’s DNS resolver (which is proxied by Cilium).
3. Respond with a crafted DNS response containing a malformed resource record. Example using Scapy:

   from scapy.all import *
   # Craft a DNS response with an invalid RDATA length
   dns_response = IP(dst="10.0.0.1")/UDP(sport=53, dport=12345)/DNS(
       id=0x1234,
       qr=1,
       qd=DNSQR(qname="example.com"),
       an=DNSRR(rrname="example.com", type="A", rdata="192.168.1.1", rdlength=9999)
   )
   send(dns_response)
   

4. Observe the Cilium agent crash (check pod logs or agent status).

Expected Outcome: The Cilium agent crashes, causing a temporary DoS for DNS-based policies.

Blue Team

Detection:

• Monitor Cilium agent logs for crash events or panic messages.
• Set up alerts for sudden drops in DNS proxy metrics (e.g., cilium_dns_proxy_requests_total).

Mitigation:

• Apply the patch by upgrading Cilium to v1.14.18, v1.15.12, or v1.16.5.
• If immediate upgrade is not possible, restrict external DNS traffic to trusted resolvers only.
• Use network policies to limit which workloads can receive external DNS responses.

Hunting:

• Search for DNS responses with malformed resource records in network traffic logs.
• Look for Cilium agent restarts in Kubernetes events.

Indicators of Compromise (IOCs)

• Network: DNS responses with invalid RDATA lengths or unexpected record types.
• Logs: Cilium agent logs containing panic, nil pointer dereference, or runtime error.
• Metrics: Sudden drop in cilium_dns_proxy_requests_total or increase in cilium_agent_crashes_total.
• Kubernetes Events: Pod restart events for cilium-* pods.

Detection Engineering

YARA Rule

rule CVE_2025_23028_Cilium_DNS_DoS {
    meta:
        description = "Detects crafted DNS responses targeting Cilium DNS proxy"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-23028"
    strings:
        $dns_header = { ?? ?? 81 80 00 01 00 01 00 00 00 00 }  // Standard DNS response header
        $malformed_rdata = { 00 0F 00 01 00 00 0E 10 00 04 }  // Example: type A, class IN, TTL 3600, rdlength 4
    condition:
        $dns_header at 0 and #malformed_rdata > 0
}

Sigma Rule

title: Cilium DNS Proxy Crash Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Cilium agent crashes caused by crafted DNS responses
author: Valters IT
date: 2025/04/10
logsource:
    product: kubernetes
    service: pod
detection:
    selection:
        pod_name: "cilium-*"
        message: "panic: runtime error: invalid memory address or nil pointer dereference"
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert udp any any -> any 53 (msg:"CVE-2025-23028 Cilium DNS Proxy DoS Attempt"; content:"|00 0F 00 01 00 00 0E 10 00 04|"; depth:20; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cilium to a patched version:
   • v1.14.18
   • v1.15.12
   • v1.16.5
2. If upgrade is not possible, restrict external DNS traffic to trusted resolvers using network policies.
3. Monitor Cilium agent logs for crash events.

Long-Term Measures:

• Implement input validation for all DNS proxy components.
• Add fuzzing for DNS response parsing in CI/CD pipelines.
• Enable automatic updates for Cilium components.

Workarounds: No known workarounds are available.

Valters IT
Securing Kubernetes, One CVE at a Time