Skip to main content

Improper Privilege Management

CVE-2022-29179

High
8.2/10

Summary

Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. In versions prior to 1.9.16, 1.10.x prior to 1.10.11, and 1.11.x prior to 1.11.5, if an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed, the attacker can escalate privileges to cluster admin by using Cilium's Kubernetes service account. The problem has been fixed and the patch is available in versions 1.9.16, 1.10.11, and 1.11.5. There are no known workarounds available.

  • LOW
  • LOCAL
  • HIGH
  • CHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-269 - Improper Privilege Management

An effective privilege management infrastructure provides valid users with required access and privileges across heterogeneous technology environments. An application with a faulty privilege management infrastructure allows higher than authorized privileges or enables privilege escalation. This can lead to security incidents such as system infiltration, data breach, and complete system takeover.

References

Advisory Timeline

  • Published