Privilege Escalation Affecting github.com/cilium/cilium package, versions <1.9.16>=1.10.0-rc0 <1.10.11>=1.11.0-rc0 <1.11.5


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMCILIUMCILIUM-2849061
  • published30 May 2022
  • disclosed30 May 2022
  • creditdaniel-f3, danmx

Introduced: 30 May 2022

CVE-2022-29178  (opens in a new tab)
CWE-264  (opens in a new tab)

How to fix?

Upgrade github.com/cilium/cilium to version 1.9.16, 1.10.11, 1.11.5 or higher.

Overview

github.com/cilium/cilium is an open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes.

Affected versions of this package are vulnerable to Privilege Escalation. Users with host file system access on a node and the privileges to run as group ID 1000 can gain access to the per-node API of Cilium via Unix domain socket on the host where Cilium is running. If a malicious user is able to gain unprivileged access to a user corresponding to this group, then they can leverage this access to compromise the integrity as well as system availability on that host.

Note: Operating Systems that have unprivileged users not belonging to the group ID 1000 are not affected by this vulnerability.

CVSS Scores

version 3.1