Privilege Escalation Affecting github.com/cilium/cilium package, versions <1.9.16 >=1.10.0-rc0 <1.10.11 >=1.11.0-rc0 <1.11.5
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMCILIUMCILIUM-2849061
- published 30 May 2022
- disclosed 30 May 2022
- credit daniel-f3, danmx
Introduced: 30 May 2022
CVE-2022-29178 Open this link in a new tabHow to fix?
Upgrade github.com/cilium/cilium to version 1.9.16, 1.10.11, 1.11.5 or higher.
Overview
github.com/cilium/cilium is an open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes.
Affected versions of this package are vulnerable to Privilege Escalation. Users with host file system access on a node and the privileges to run as group ID 1000 can gain access to the per-node API of Cilium via Unix domain socket on the host where Cilium is running. If a malicious user is able to gain unprivileged access to a user corresponding to this group, then they can leverage this access to compromise the integrity as well as system availability on that host.
Note: Operating Systems that have unprivileged users not belonging to the group ID 1000 are not affected by this vulnerability.