Listen to this Post
The CVE-2024-XXXX vulnerability stems from insufficient destination address validation in Omni’s SideroLink WireGuard interface. Omni configures its WireGuard interface to only validate that incoming packets originate from the correct source IPv6 address assigned to a specific Talos machine peer. However, it does not check the destination IP address of these packets. This flaw is critical because the Talos machine’s SideroLink interface is untrusted; Kubernetes workloads with hostNetwork access can craft and send arbitrary packets. When IP forwarding is disabled on Omni (the default), an attacker can directly target services on the Omni instance itself, such as internal APIs. If IP forwarding is enabled, the impact escalates significantly, allowing an attacker to route packets to other Talos peers connected to Omni or even into Omni’s internal network, facilitating lateral movement and further exploitation. The fix involves implementing proper destination address filtering on the WireGuard interface to ensure packets are only accepted if they are destined for Omni’s designated ::1 address within the SideroLink network block.
Platform: Omni
Version: < 0.48.0
Vulnerability: Access Control Bypass
Severity: Critical
date: 2024-XX-XX
Prediction: Patch available (0.48.0)
What Undercode Say:
Check Omni version omnictl version Simulate packet from Talos peer to unauthorized destination sudo ip -6 route show table all Check if IP forwarding is enabled on Omni host cat /proc/sys/net/ipv6/conf/all/forwarding Example netfilter rule to block unauthorized SideroLink traffic (workaround) ip6tables -A INPUT -i siderolink -d ! fdae:...:...::1/128 -j DROP
How Exploit:
A malicious pod with hostNetwork: true on a Talos machine crafts IPv6 packets with a legitimate source address but a destination address set to another Talos peer’s IP (e.g., fdae:…:…::2) or an internal Omni network address. It sends these packets via the SideroLink interface. Omni’s WireGuard accepts them due to valid source IP, and if IP forwarding is enabled, routes them to the unintended target.
Protection from this CVE:
Upgrade to Omni >=0.48.0. If unable to patch immediately, ensure net.ipv6.conf.all.forwarding=0 on the Omni instance and implement strict host-level firewall rules using ip6tables to drop all SideroLink traffic not explicitly destined for the Omni service’s IP.
Impact:
Lateral movement, unauthorized access to Omni services and APIs, potential compromise of the Omni management plane and connected Talos clusters.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
