8.7

CVE-2024-47825: cilium Incorrect Default Permissions

CVSS: 8.7v3.1HighAnalyzed
AliasesCGA-525q-62rw-p5r4CGA-88fr-7537-p797CGA-hw93-mxw7-v43v
Published 21-10-2024Last modified 21-10-2024
Open JSON

Vulnerability summary

CVE-2024-47825 is a high (CVSS 8.7) Incorrect Default Permissions vulnerability in cilium. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.6% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.7/10
010
High · v3.1 (NVD)
EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 7
OPENSUSE-SU-2024:0350-1OPENSUSE-SU-2024:14447-1SUSE-SU-2024:3911-1CGA-5MHJ-X4J3-C4W6CGA-7FH5-FH43-3F87CGA-H87M-VW5P-J5W3

Timeline

  1. 21-10-2024
    PublishedVulnerability first disclosed.
  2. 21-10-2024
    Last modifiedVulnerability information updated.

Description

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

0.00 pp

From 0.40% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard20 products
  • cilium-1.15< 1.15.10-r0 | < 1.15.19-r3
  • cilium-1.15-clustermesh-apiserver< 1.15.10-r0
  • cilium-1.15-container-init< 1.15.10-r0
  • cilium-1.15-container-init-compat< 1.15.10-r0
  • cilium-1.15-hubble-relay< 1.15.10-r0
Wolfi2 products
  • hubble-ui< 0.13.1-r7
  • hubble-ui-backend< 0.13.1-r7
Cilium1 product
  • cilium≥ 1.14.0, < 1.14.16 | ≥ 1.15.0, < 1.15.10
Github.com/cilium1 product
  • cilium≥ 1.14.0, < 1.14.16 | ≥ 1.15.0, < 1.15.10

4 vendors · 24 products

References

6 links