CVE-2024-47825 CIDR deny policies may not take effect when a more narrow CIDR allow is present
Attackers can bypass CIDR deny policies in Cilium when specific allow rules are configured, potentially accessing restricted network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47825?
CVE-2024-47825 is a medium-severity vulnerability in cilium, published on 21 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule referencing a more narrow prefix (`CIDRSet` or `toFQDN`) and this narrower policy rule specifies either `enableDefaultDeny: false` or `- toEntities: all`. Note that a rule specifying `toEntities: world` or `toEntities: 0.0.0.0/0` is insufficient, it must be to entity `all`.This issue has been patched in Cilium v1.14.16 and v1.15.10. As this issue only affects policies using `enableDefaultDeny: false` or that set `toEntities` to `all`, some workarounds are available. For users with policies using `enableDefaultDeny: false`, remove this configuration option and explicitly define any allow rules required. For users with egress policies that explicitly specify `toEntities: all`, use `toEntities: world`.
Weakness: CWE-276
Which versions are affected by CVE-2024-47825?
8 open source packages ship an affected version, including github.com/cilium/cilium, cilium and cilium-operator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cilium/cilium Go | From 1.14.0 | 1.14.16, 1.15.10 |
github.com/cilium/cilium Go | From 1.14.0 | 1.14.16 |
github.com/cilium/cilium Go | From 1.14.0 | 1.14.16 |
github.com/cilium/cilium Go | From 1.15.0 | 1.15.10 |
github.com/cilium/cilium Go | From 1.15.0 | 1.15.10 |
cilium Bitnami | From 1.15.4 | 1.16.0 |
2 more packages
cilium-operator Bitnami | From 1.15.4 | 1.16.0 |
hubble-relay Bitnami | From 1.14.0 | 1.16.0 |
Products include Cilium Cilium.
How do I fix CVE-2024-47825?
Upgrade github.com/cilium/cilium to a fixed version for your release line: 1.14.16 or 1.15.10.
Is CVE-2024-47825 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47825 exists.
Other vulnerabilities in cilium
- CVE-2026-49445 Cilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access
- CVE-2022-29178 Incorrect Default Permissions in Cilium
- CVE-2024-28860 Insecure IPsec transport encryption in Cilium
- CVE-2026-41520 Cillium exposes sensitive information included in the cilium-bugtool debug archive
- CVE-2024-37307 Cilium leaks sensitive information in cilium-bugtool
Sources
Also known as BIT-cilium-2024-47825, BIT-cilium-operator-2024-47825, BIT-hubble-relay-2024-47825, GHSA-3wwx-63fv-pfq6, GO-2024-3208.