CVE-2025-64715

Executive Summary

CVE-2025-64715 is a vulnerability in Cilium, a networking, observability, and security solution with an eBPF-based dataplane. The flaw resides in the CiliumNetworkPolicy (CNP) resource, specifically when using egress.toGroups.aws.securityGroupsIds to reference AWS security group IDs. If the referenced security group IDs do not exist or are not attached to any network interface, the toCIDRset section of the derived policy is not generated. This omission can cause the policy to permit outbound traffic to more destinations than intended, effectively bypassing the intended egress restrictions.

The vulnerability has a CVSS score of 4.0 (Medium) and affects Cilium versions prior to 1.16.17, 1.17.10, and 1.18.4. No public proof-of-concept (PoC) or exploit code is available at this time. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild currently.

Supply Chain & Package Security

Cilium is distributed as a container image and via Helm charts. Users should verify the integrity of their Cilium images and ensure they are pulling from trusted registries. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but rather to the core Cilium binary and its Kubernetes integration.

CVSS Breakdown & Threat Level

• CVSS Score: 4.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): None (N) – No integrity impact.
• Availability (A): None (N) – No availability impact.

Threat Level: Medium. The vulnerability allows for potential egress policy bypass, which could lead to data exfiltration or unauthorized outbound connections. However, exploitation requires specific conditions (non-existent or unattached security group IDs) and no public exploit exists.

Deep Dive & Mechanics

Cilium uses eBPF to enforce network policies in Kubernetes. The CiliumNetworkPolicy resource allows users to define fine-grained ingress and egress rules. The toGroups feature enables dynamic policy generation based on AWS security group IDs. When a policy specifies egress.toGroups.aws.securityGroupsIds, Cilium queries the AWS EC2 API to resolve the security group IDs to a set of CIDR ranges (via the toCIDRset field). This resolved CIDR set is then used to enforce egress rules.

The vulnerability occurs when the referenced security group IDs either:

1. Do not exist in the AWS account.
2. Exist but are not attached to any network interface (ENI).

In such cases, the AWS API returns an empty or error response. Cilium's policy generation logic fails to produce the toCIDRset section, leaving the egress rule without any destination restrictions. As a result, the policy may allow outbound traffic to any IP address, effectively bypassing the intended egress controls.

The root cause is a lack of proper error handling and validation when resolving security group IDs. The policy engine should either fail-closed (deny all egress) or generate an empty toCIDRset that results in no allowed destinations. Instead, it fails-open, permitting unrestricted outbound access.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In policy generation logic
func resolveSecurityGroupIDs(sgIDs []string) ([]string, error) {
    // Query AWS API
    cidrs, err := awsClient.DescribeSecurityGroups(sgIDs)
    if err != nil {
        // Error handling is missing or incomplete
        return nil, nil // Returns nil, nil instead of error
    }
    return cidrs, nil
}

// In policy builder
cidrs, err := resolveSecurityGroupIDs(policy.Spec.Egress.ToGroups)
if err != nil {
    // Log error but continue without generating toCIDRset
    log.Warn("Failed to resolve security groups")
}
// If cidrs is nil, toCIDRset is not generated, leading to permissive egress

Patched Code (Conceptual):

func resolveSecurityGroupIDs(sgIDs []string) ([]string, error) {
    cidrs, err := awsClient.DescribeSecurityGroups(sgIDs)
    if err != nil {
        return nil, fmt.Errorf("failed to resolve security groups: %w", err)
    }
    if len(cidrs) == 0 {
        // Fail-closed: return error to prevent policy generation
        return nil, fmt.Errorf("no CIDRs resolved from security groups")
    }
    return cidrs, nil
}

// In policy builder
cidrs, err := resolveSecurityGroupIDs(policy.Spec.Egress.ToGroups)
if err != nil {
    // Fail-closed: deny all egress or skip policy generation
    return nil, fmt.Errorf("policy generation failed: %w", err)
}
// Only generate toCIDRset if cidrs is non-empty

The patched versions (1.16.17, 1.17.10, 1.18.4) include proper error handling that causes the policy generation to fail when security group IDs cannot be resolved, preventing the permissive egress behavior.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Kubernetes cluster with Cilium installed (vulnerable version).
• Ability to create or modify CiliumNetworkPolicy resources.
• AWS credentials with permissions to describe security groups (or the ability to reference non-existent security group IDs).

Exploitation Steps:

1. Create a CiliumNetworkPolicy that uses egress.toGroups.aws.securityGroupsIds with a non-existent or unattached security group ID.
2. Apply the policy to a pod that should have restricted egress.
3. Observe that the pod can now initiate outbound connections to arbitrary IP addresses, bypassing the intended restrictions.

Example Policy (YAML):

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: vulnerable-egress-policy
spec:
  endpointSelector:
    matchLabels:
      app: my-app
  egress:
  - toGroups:
    - aws:
        securityGroupsIds:
        - "sg-12345678"  # Non-existent or unattached SG

Verification:

# From within the pod
curl -v http://example.com  # Should succeed if policy is bypassed

Blue Team

Detection:

• Monitor Cilium agent logs for errors related to security group resolution.
• Look for policies that reference non-existent or unattached security group IDs.
• Use network flow monitoring to detect unexpected outbound connections from pods with such policies.

Mitigation:

• Immediately upgrade Cilium to a patched version (1.16.17, 1.17.10, or 1.18.4).
• Audit existing CiliumNetworkPolicy resources for use of toGroups with AWS security groups.
• Validate that all referenced security group IDs exist and are attached to ENIs.
• Implement network segmentation and monitoring to detect anomalous egress traffic.

Indicators of Compromise (IOCs)

• Cilium Agent Logs: Errors containing "failed to resolve security groups" or "no CIDRs resolved".
• Network Flows: Unexpected outbound connections from pods with CiliumNetworkPolicy using toGroups.
• Policy Audit: CiliumNetworkPolicy resources with egress.toGroups.aws.securityGroupsIds referencing non-existent or unattached security group IDs.
• Cilium Version: Versions prior to 1.16.17, 1.17.10, or 1.18.4.

Detection Engineering

YARA Rule

rule CVE_2025_64715_Cilium_Policy_Bypass {
    meta:
        description = "Detects CiliumNetworkPolicy YAML files with potentially vulnerable toGroups configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64715"
    strings:
        $sg_ref = /securityGroupsIds:\s*\[?\s*["']sg-[a-f0-9]{8,}["']/ nocase
        $to_groups = "toGroups" nocase
        $aws = "aws" nocase
    condition:
        all of ($to_groups, $aws) and #sg_ref > 0
}

Sigma Rule

title: Cilium Egress Policy Bypass via Invalid Security Group IDs
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Cilium agent errors related to failed security group resolution, indicating potential exploitation of CVE-2025-64715.
author: Valters IT
date: 2025-04-10
logsource:
    product: cilium
    service: agent
detection:
    selection:
        - "failed to resolve security groups"
        - "no CIDRs resolved"
    condition: selection
falsepositives:
    - Legitimate misconfiguration of security group IDs
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64715 Cilium Egress Policy Bypass - Unexpected Outbound Connection"; flow:to_server; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Note: This is a generic rule for detecting unexpected outbound connections. Adjust based on specific environment and known good traffic patterns.

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cilium to version 1.16.17, 1.17.10, or 1.18.4 (or later).
2. Audit all CiliumNetworkPolicy resources that use egress.toGroups.aws.securityGroupsIds.
3. Validate that all referenced security group IDs exist and are attached to at least one network interface.

Long-Term Measures:

• Implement policy-as-code with validation checks to prevent deployment of policies with invalid security group references.
• Use network flow monitoring tools (e.g., Cilium Hubble, Falco) to detect anomalous egress traffic.
• Regularly review and update Cilium to the latest stable version.
• Consider using alternative policy mechanisms (e.g., toCIDR or toFQDN) if toGroups is not strictly necessary.

Workarounds:

• No workarounds are available for this issue. Upgrade is required.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert