Denial Of Service vulnerability discovered in Golang. (CVE-2022-27664) in vpc-cni plugins

[gaborho]

What happened:
Our cloud security platform discovered "Denial Of Service vulnerability discovered in Golang. (CVE-2022-27664)" in our Bottlerocket OS based EKS worker nodes. Please see the affected packages below.
We believe those cni-plugins are part of vpc-cni addon, and are from upstream. Please advise how to patch that vulnerability.

Attach logs
EKS Version: 1.24
Bottlerocket version: Bottlerocket OS 1.12.0 (aws-k8s-1.24)

What you expected to happen:
Not only aws-cni binary is patched, but also upstream plugins.

How to reproduce it (as minimally and precisely as possible):
Please see my summary here, and how I was testing:

Case #1 vpc-cni plugin v1.11.4-eksbuild.1

SSM to Bottlerocket control container, then entering to admin container with enter-admin-container command, then go into Bottlerocket host's root fs using 'sheltie' command.
Then cd to /var/lib/cni-plugins/.overlay/upper/

then use command:

grep -ai 'go1.' aws-cni -> go1.18.3

grep -ai 'go1.' bandwidth -> go1.17.7
grep -ai 'go1.' portmap -> go1.17.7
grep -ai 'go1.' loopback -> go1.17.7

===

Case #2 vpc-cni plugin v1.12.2-eksbuild.1

grep -ai 'go1.' aws-cni -> go1.19.2

grep -ai 'go1.' bandwidth -> go1.17.7
grep -ai 'go1.' portmap -> go1.17.7
grep -ai 'go1.' loopback -> go1.17.7
grep -ai 'go1.' host-local -> go1.17.7

Please verify/reproduce on your side, and let me know how to continue and how to get rid of this vulnerability finding.

Environment:

• Kubernetes version (use kubectl version):
  Server Version: version.Info{Major:"1", Minor:"24+", GitVersion:"v1.24.8-eks-ffeb93d", GitCommit:"abb98ec0631dfe573ec5eae40dc48fd8f2017424", GitTreeState:"clean", BuildDate:"2022-11-29T18:45:03Z", GoVersion:"go1.18.8", Compiler:"gc", Platform:"linux/amd64"}
• CNI Version:
  v1.11.4-eksbuild.1 and v1.12.2-eksbuild.1
• OS (e.g: cat /etc/os-release):
  NAME=Bottlerocket
  ID=bottlerocket
  VERSION="1.12.0 (aws-k8s-1.24)"
  PRETTY_NAME="Bottlerocket OS 1.12.0 (aws-k8s-1.24)"
  VARIANT_ID=aws-k8s-1.24
  VERSION_ID=1.12.0
  BUILD_ID=6ef1139f
  HOME_URL="https://github.com/bottlerocket-os/bottlerocket"
  SUPPORT_URL="https://github.com/bottlerocket-os/bottlerocket/discussions"
  BUG_REPORT_URL="https://github.com/bottlerocket-os/bottlerocket/issues"
• Kernel (e.g. uname -a):
  Linux ... 5.15.79 Initial commit of amazon-vpc-cni-k8s #1 SMP Wed Jan 25 03:35:24 UTC 2023 x86_64 GNU/Linux

[gaborho]

Probably Bottlerocket has to update 0.9.1 version: bottlerocket-os/bottlerocket#2840
Opened an issue on their side as well.

[jdn5126]

Hi @gaborho , yes, we are aware of this CVE. I believe it is already fixed in the latest release, v1.12.5, but I can confirm. In the future, please follow the rules on security disclosures: https://github.com/aws/amazon-vpc-cni-k8s#security-disclosures

Note that VPC CNI is not susceptible to this issue anyway as it does not accept outside HTTP connections.

[gaborho]

Hi @jdn5126 I upgraded Amazon VPC CNI plugin on our test cluster to version v1.12.5-eksbuild.1. The issue still persist, below mentioned binaries seems to be still built with golang 1.17.x . I checked in both /opt/cni/bin and also in /var/lib/cni-plugins/.overlay/upper dir.

bash-5.1# list=("aws-cni" "bandwidth" "egress-v4-cni" "host-local" "loopback" "portmap")

bash-5.1# for i in ${list[@]}; do grep -aiHFo 'go1.17' /var/lib/cni-plugins/.overlay/upper/$i; done
/var/lib/cni-plugins/.overlay/upper/bandwidth:go1.17
/var/lib/cni-plugins/.overlay/upper/host-local:go1.17
/var/lib/cni-plugins/.overlay/upper/loopback:go1.17
/var/lib/cni-plugins/.overlay/upper/portmap:go1.17

bash-5.1# for i in ${list[@]}; do grep -aiHFo 'go1.17' /opt/cni/bin/$i; done
/opt/cni/bin/bandwidth:go1.17
/opt/cni/bin/host-local:go1.17
/opt/cni/bin/loopback:go1.17
/opt/cni/bin/portmap:go1.17

bash-5.1# for i in ${list[@]}; do sha256sum /opt/cni/bin/$i; done
9cc0d133cf08465a37f137df14aad65027bbe77b4da1048a6b7be6711e481db7  /opt/cni/bin/aws-cni
685c70eaea079ffeead19f78ddb80086c1afdc814aea30e1c4d5970cff9cccf8  /opt/cni/bin/bandwidth
73668719347866920bb4f04edb4254b8926ce782c2031f0f3f1f5bb344974d3a  /opt/cni/bin/egress-v4-cni
34977e75abd952f24289f6e9fa5e13cc9c72b8b9c498f24136c347af02a56efa  /opt/cni/bin/host-local
efe775675adc16cb6ed99017ec6b863c21578e6021bb606738ed33d576a006ad  /opt/cni/bin/loopback
3c73a1c9dac080ab1579a50e237e0483983c3c4e7708494dd440bef975c9c897  /opt/cni/bin/portmap

bash-5.1# for i in ${list[@]}; do sha256sum /var/lib/cni-plugins/.overlay/upper/$i; done
9cc0d133cf08465a37f137df14aad65027bbe77b4da1048a6b7be6711e481db7  /var/lib/cni-plugins/.overlay/upper/aws-cni
685c70eaea079ffeead19f78ddb80086c1afdc814aea30e1c4d5970cff9cccf8  /var/lib/cni-plugins/.overlay/upper/bandwidth
73668719347866920bb4f04edb4254b8926ce782c2031f0f3f1f5bb344974d3a  /var/lib/cni-plugins/.overlay/upper/egress-v4-cni
34977e75abd952f24289f6e9fa5e13cc9c72b8b9c498f24136c347af02a56efa  /var/lib/cni-plugins/.overlay/upper/host-local
efe775675adc16cb6ed99017ec6b863c21578e6021bb606738ed33d576a006ad  /var/lib/cni-plugins/.overlay/upper/loopback
3c73a1c9dac080ab1579a50e237e0483983c3c4e7708494dd440bef975c9c897  /var/lib/cni-plugins/.overlay/upper/portmap

[jdn5126]

I will work on getting aws-cni and egress-v4-cni build with go 1.19.6 for a future release. The other plugins are from upstream (https://github.com/containernetworking/plugins/release). Currently, we use version 1.1.1 (https://github.com/aws/amazon-vpc-cni-k8s/blob/master/Makefile#L259), and 1.2.0 is now available upstream. It looks like they still have affected versions, though, so an issue would need to be filed there

[vbrinza]

Waiting for the patch too.

[jdn5126]

Waiting for the patch too.

The VPC CNI update will be shipped in the next release

[jayanthvn]

1.12.6 is released with the fix #2303 so closing this issue.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.