GO-2022-0457
and 11 other vulnerabilities
GO-2022-0457 : Access to Unix domain socket can lead to privileges escalation in Cilium in github.com/cilium/cilium
GO-2022-0458 : Improper Privilege Management in Cilium in github.com/cilium/cilium
GO-2022-0959 : Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels in github.com/cilium/cilium
GO-2023-1643 : Potential network policy bypass when routing IPv6 traffic in github.com/cilium/cilium
GO-2023-1730 : Debug mode leaks confidential data in Cilium in github.com/cilium/cilium
GO-2023-1785 : Potential HTTP policy bypass when using header rules in Cilium in github.com/cilium/cilium
GO-2023-2078 : Kubernetes users may update Pod labels to bypass network policy in github.com/cilium/cilium
GO-2023-2079 : Specific Cilium configurations vulnerable to DoS via Kubernetes annotations in github.com/cilium/cilium
GO-2023-2080 : Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy in github.com/cilium/cilium
GO-2024-2656 : Unencrypted traffic between nodes with IPsec in github.com/cilium/cilium
GO-2024-2666 : Insecure IPsec transparent encryption in github.com/cilium/cilium
GO-2024-3072 : Policy bypass for Host Firewall policy due to race condition in Cilium agent in github.com/cilium/cilium
Discover Packages
github.com/cilium/cilium
pkg
sockops
package
Version:
v1.9.5
Opens a new window with list of versions in this module.
Published: Mar 10, 2021
License: Apache-2.0
Opens a new window with license information.
Imports: 17
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.
Documentation
¶
SkmsgDisable "unloads" the SK_MSG program. This simply deletes
the file associated with the program.
SkmsgEnable will compile and attach the SK_MSG programs to the
sockmap. After this all sockets added to the cilium_sock_ops will
have sendmsg/sendfile calls running through BPF program.
SockmapDisable will detach any sockmap programs from cgroups then "unload"
all the programs and maps associated with it. Here "unload" just means
deleting the file associated with the map.
func SockmapEnable() error
SockmapEnable will compile sockops programs and attach the sockops programs
to the cgroup. After this all TCP connect events will be filtered by a BPF
sockops program.
¶
Click to show internal directories.
Click to hide internal directories.
Affected by 
Documentation
¶
Source Files