Bug 2053326 (CVE-2022-0567)

Summary:	CVE-2022-0567 ovn-kubernetes: Ingress network policy can be overruled by egress network policy on another pod
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, anusaxen, aos-bugs, bbennett, bmontgom, danw, dcbw, eparis, jburrell, jokerman, jtanenba, nstielau, rbrattai, security-response-team, sponnaga, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	OCP v 4.10.8 OCP v 4.9.27 OCP v 4.7.47 OCP v 4.8.36	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster, allowing network traffic to access pods that should not be reachable. This issue results in information disclosure and other attacks on other pods that should not be reachable.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-04-11 22:08:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2037647, 2055372, 2055373, 2055378, 2055379, 2055380, 2055381
Bug Blocks:	2047950, 2053680

Description Sam Fowler 2022-02-11 00:52:07 UTC

When using ovn-kubernetes on a Kubernetes or OpenShift cluster, it is possible to create an egress network policy that bypasses existing an ingress policy, allowing netwrok traffic to access pods that should not be reachable. This attack is limited to pods on the same node.

Comment 10 errata-xmlrpc 2022-04-08 05:04:19 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.10

Via RHSA-2022:1162 https://access.redhat.com/errata/RHSA-2022:1162

Comment 11 errata-xmlrpc 2022-04-08 09:56:15 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.9

Via RHSA-2022:1158 https://access.redhat.com/errata/RHSA-2022:1158

Comment 12 errata-xmlrpc 2022-04-11 11:28:42 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.7

Via RHSA-2022:1166 https://access.redhat.com/errata/RHSA-2022:1166

Comment 13 errata-xmlrpc 2022-04-11 20:04:47 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.8

Via RHSA-2022:1154 https://access.redhat.com/errata/RHSA-2022:1154

Comment 14 Product Security DevOps Team 2022-04-11 22:08:40 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0567