-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description and commit message indicate a race condition where packets from terminating endpoints might not be encrypted. The patch (commit 0de9ea6ec94ceb16b7c16924f048a83e7332dbc2) modifies wg_maybe_redirect_to_encrypt in bpf/lib/wireguard.h and its caller in bpf/bpf_host.c. The core issue was that wg_maybe_redirect_to_encrypt previously performed an ipcache lookup for the source security identity. This lookup could fail or return an incorrect identity for a terminating endpoint due to the race condition, leading to encryption being skipped. The patch changes wg_maybe_redirect_to_encrypt to accept the source security identity (obtained earlier and more reliably from skb->mark via cil_to_netdev) as a parameter, thus avoiding the racy ipcache lookup within the function itself for determining the source identity. Therefore, the pre-patch version of wg_maybe_redirect_to_encrypt is identified as the vulnerable function because its logic for determining the source security identity was flawed under race conditions for terminating pods, leading to incorrect encryption decisions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cilium/cilium | go | >= 1.13.0, < 1.15.16 | 1.15.16 |
| github.com/cilium/cilium | go | >= 1.16.0, < 1.16.9 | 1.16.9 |
| github.com/cilium/cilium | go | >= 1.17.0, < 1.17.3 | 1.17.3 |
A Semantic Attack on Google Gemini - Read the Latest Research