Listen to this Post
The CNI portmap plugin is used in container networking to map a host’s port to a container (HostPort). When configured to use the `nftables` backend instead of the default iptables, a flaw occurs in the rule generation. The plugin incorrectly creates `nftables` rules that match only on the destination port number, omitting the crucial destination IP address filter. This causes the rule to catch all network packets destined for that port on any IP address assigned to the host’s network interfaces, including those belonging to other containers (pods). Consequently, traffic intended for a different pod on the same node, but sharing the same port number, is wrongly redirected to the pod that requested the HostPort forwarding. This breaks network isolation and allows a pod to intercept traffic meant for other workloads on the node.
Platform: CNI Plugins
Version: v1.8.0 earlier
Vulnerability: HostPort Traffic Misrouting
Severity: Critical
date: 2022-04-28
Prediction: Patch Available
What Undercode Say:
cat /etc/cni/net.d/.conf | grep -A5 -B5 portmap
nft list ruleset | grep -i "tcp dport"
{"type": "portmap", "capabilities": {"portMappings": true}, "snat": true, "backend": "iptables"}
How Exploit:
1. Deploy malicious pod.
2. Request HostPort mapping.
3. Intercept cluster traffic.
Protection from this CVE
Upgrade to version 1.9.0. Explicitly set backend to `iptables` in CNI configuration. Avoid using nftables backend.
Impact:
Traffic interception. Network isolation breach. Pod spoofing potential.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
