Improper Isolation in Amazon EKS Network Policy Agent

Executive Summary

This vulnerability involves improper isolation of shared resources in the aws-network-policy-agent component of Amazon EKS Network Policy Agent before version 1.3.7 (part of VPC CNI before 1.22.3). An authenticated adjacent user could exploit this by using crafted AF_PACKET frames to poison eBPF conntrack maps, potentially bypassing NetworkPolicy ingress enforcement on co-located pods.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking for signs of eBPF conntrack map poisoning or unauthorized AF_PACKET frame usage. Monitor network policy agent logs for anomalies and inspect eBPF maps for unexpected entries. Commands may include checking pod logs, inspecting eBPF maps with tools like bpftool, and reviewing NetworkPolicy enforcement logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker with adjacent network access could bypass network policies meant to restrict pod-to-pod communication. This may allow unauthorized access to sensitive services or data running on affected pods, leading to potential data breaches or lateral movement within the cluster.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable versions may fail compliance audits due to insufficient network isolation controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Amazon VPC CNI Managed Add-on v1.22.3 or later which includes Network Policy Agent v1.3.7 to address the improper isolation issue.

Useful 0 Not Useful 0