Cilium Wireguard Encryption Race Condition Vulnerability

A vulnerability exists in Cilium versions 1.15.0 prior to 1.15.16, 1.16.0 prior to 1.16.9, and 1.17.0 prior to 1.17.3, when Wireguard transparent encryption is used. Due to a race condition in traffic processing, packets from terminating endpoints can leave the source node unencrypted. This issue arises for packets where the source endpoint has been dismantled before the packet reaches the network interface, causing the packet to bypass encryption.

Impact

Exploitation of this vulnerability can lead to unencrypted packet transmission from terminating endpoints in a Cilium cluster using Wireguard encryption, potentially exposing sensitive data.

Remediation

Users can upgrade to Cilium versions 1.15.16, 1.16.9, or 1.17.3 to address this vulnerability.