3.5

CVE-2023-41332: Denial of service via Kubernetes annotations in specific Cilium configurations

Modified
AliasesCGA-p877-6fqx-h4c5CGA-x872-vjvq-rj6xGHSA-24m5-r6hv-ccgp
Published 26-09-2023Last modified 23-09-2024

Vulnerability summary

CVE-2023-41332 is a low (CVSS 3.5) vulnerability in cilium. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
3.5/10
010
Low · v3.1 (CVE.org)
EPSS score
0.51%
0%100%
Low · +0.07 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 6
CGA-2M93-5JX3-CJ2WCGA-2X9M-P2JF-2P6RCGA-MF6J-RQ9V-HH7PCGA-P93G-C4C7-2HF8CGA-QJ5W-FRXP-C7PFCGA-RR8W-W25G-35R5

Timeline

  1. 26-09-2023
    PublishedVulnerability first disclosed.
  2. 23-09-2024
    Last modifiedVulnerability information updated.

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with `policy.cilium.io/proxy-visibility` annotations (in Cilium >= v1.13) or `io.cilium.proxy-visibility` annotations (in Cilium <= v1.12) causes the Cilium agent to segfault on the node to which the workload is assigned. Existing traffic on the affected node will continue to flow, but the Cilium agent on the node will not able to process changes to workloads running on the node. This will also prevent workloads from being able to start on the affected node. The denial of service will be limited to the node on which the workload is scheduled, however an attacker may be able to schedule workloads on the node of their choosing, which could lead to targeted attacks. This issue has been resolved in Cilium versions 1.14.2, 1.13.7, and 1.12.14. Users unable to upgrade can avoid this denial of service attack by enabling the Layer 7 proxy.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

Increase +0.07 pp

From 0.45% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Cilium

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard18 products
  • cilium-1.15All versions (No fix recorded)
  • cilium-1.15-clustermesh-apiserverAll versions (No fix recorded)
  • cilium-1.15-container-initAll versions (No fix recorded)
  • cilium-1.15-container-init-compatAll versions (No fix recorded)
  • cilium-1.15-hubble-relayAll versions (No fix recorded)
Cilium1 product
  • cilium< 1.12.14 | ≥ 1.13.0, < 1.13.7 | ≥ 1.14.0, < 1.14.2
Github.com/cilium1 product
  • cilium< 1.12.14 | ≥ 1.13.0, < 1.13.7 | ≥ 1.14.0, < 1.14.2
Wolfi1 product
  • hubble-ui-backendAll versions (No fix recorded)

4 vendors · 21 products

References

5 links