GHSA-59qg-grp7-5r73

Suggest an improvement
Source
https://github.com/advisories/GHSA-59qg-grp7-5r73
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-59qg-grp7-5r73/GHSA-59qg-grp7-5r73.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-59qg-grp7-5r73
Aliases
Published
2021-05-27T19:00:08Z
Modified
2023-11-08T04:02:05.492713Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
Summary
Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements
Details

Impact

An attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert themselves as a fake service.

In a cluster with an IPv4 internal network, if IPv6 is not totally disabled on the host (via ipv6.disable=1 on the kernel cmdline), it will be either unconfigured or configured on some interfaces, but it’s pretty likely that ipv6 forwarding is disabled, ie /proc/sys/net/ipv6/conf//forwarding == 0. Also by default, /proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2 sysctls means that the host accepts router advertisements and configure the IPv6 stack using them.

By sending “rogue” router advertisements, an attacker can reconfigure the host to redirect part or all of the IPv6 traffic of the host to the attacker controlled container. Even if there was no IPv6 traffic before, if the DNS returns A (IPv4) and AAAA (IPv6) records, many HTTP libraries will try to connect via IPv6 first then fallback to IPv4, giving an opportunity to the attacker to respond. If by chance you also have on the host a vulnerability like last year’s RCE in apt (CVE-2019-3462), you can now escalate to the host.

Patches

Weave Net version 2.6.3 (to be released soon) will disable the accept_ra option on the veth devices that it creates.

Workarounds

Users should not run containers with CAPNETRAW capability. This has been the advice from Weave Net for years. https://www.weave.works/docs/net/latest/kubernetes/kube-addon/#-securing-the-setup

For more information

If you have any questions or comments about this advisory: * Open an issue in the Weave Net repo * Join the <a href="https://slack.weave.works/" target="_blank">Weave Users Slack</a>.

References

Affected packages

Go / github.com/weaveworks/weave

Package

Name
github.com/weaveworks/weave
View open source insights on deps.dev
Purl
pkg:golang/github.com/weaveworks/weave

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6.3