Cilium v1.17 Security Update: Memory Leaks, Panics, and IPAM Bugs Fix

Vulnerability Overview v1.17 Fixed incorrect policy service selector handling (#44950, @fristonio). envoy Fixed the XDS server NPDs listener count issue (Backport PR #45262, Upstream PR #44830, @fristonio). v1.17 Fixed a slow memory leak triggered by incremental policy updates (Backport PR #45054, Upstream PR #44328, @odinuge). v1.17 Fixed endpoints getting stuck in "waiting for regeneration" (Backport PR #44825, Upstream PR #44255, @odinuge). v1.17 Fixed memory leaks triggered by policy creation and deletion (Backport PR #44025, Upstream PR #44724, @odinuge). v1.17 Fixed a panic in Hubble Relay when a new address is unresolvable (Backport PR #45238, Upstream PR #45021, @pesarkhobee). v1.17 Fixed a bug in dual-stack cluster IPAM that could cause the IPv4 PodCIDR of affected nodes to be erroneously released and reassigned to another node (Backport PR #44868, Upstream PR #44832, @christarazi). v1.17 Fixed the issue where policy update confirmations were never completed after endpoint deletion (Backport PR #44820, Upstream PR #44754, @rajahalme). v1.17 Fixed hanging ipcache identity updates when the last proxy listener is removed (Backport PR #45262, Upstream PR #44597, @rajahalme). v1.17 Fixed increased CPU usage in due to the log coloring feature, even when coloring is disabled (Backport PR #44825, Upstream PR #44119, @ptoreba). v1.17 Fixed nil pointer dereference of during shutdown (Backport PR #45238, Upstream PR #45091, @tsotne95). Impact Scope The aforementioned vulnerabilities affect multiple components of Cilium, including policy service selectors, the Envoy server, memory management, Hubble Relay, IPAM, ipcache identity updates, log coloring functionality, and operatorIdentity. Remediation v1.17 Fixed incorrect policy service selector handling (#44950, @fristonio). envoy Fixed the XDS server NPDs listener count issue (Backport PR #45262, Upstream PR #44830, @fristonio). v1.17 Fixed a slow memory leak triggered by incremental policy updates (Backport PR #45054, Upstream PR #44328, @odinuge). v1.17 Fixed endpoints getting stuck in "waiting for regeneration" (Backport PR #44825, Upstream PR #44255, @odinuge). v1.17 Fixed memory leaks triggered by policy creation and deletion (Backport PR #44025, Upstream PR #44724, @odinuge). v1.17 Fixed a panic in Hubble Relay when a new address is unresolvable (Backport PR #45238, Upstream PR #45021, @pesarkhobee). v1.17 Fixed a bug in dual-stack cluster IPAM that could cause the IPv4 PodCIDR of affected nodes to be erroneously released and reassigned to another node (Backport PR #44868, Upstream PR #44832, @christarazi). v1.17 Fixed the issue where policy update confirmations were never completed after endpoint deletion (Backport PR #44820, Upstream PR #44754, @rajahalme). v1.17 Fixed hanging ipcache identity updates when the last proxy listener is removed (Backport PR #45262, Upstream PR #44597, @rajahalme). v1.17 Fixed increased CPU usage in due to the log coloring feature, even when coloring is disabled (Backport PR #44825, Upstream PR #44119, @ptoreba). v1.17 Fixed nil pointer dereference of during shutdown (Backport PR #45238, Upstream PR #45091, @tsotne95). POC Code or Exploit Code No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Cilium v1.17 Security Update: Memory Leaks, Panics, and IPAM Bugs Fix

More from this source