CVE-2021-34824: Istio sensitive information vulnerability alert
Vulnerability Detail
The Istio
Gateway
andDestinationRule
can load private keys and certificates from Kubernetes secrets via thecredentialName
configuration. For Istio 1.8 and above, the secrets are conveyed from Istiod to gateways or workloads via the XDS API.In the above approach, a gateway or workload deployment should only be able to access credentials (TLS certificates and private keys) stored in the Kubernetes secrets within its namespace. However, a bug in Istiod permits an authorized client the ability to access and retrieve any TLS certificate and private key cached in Istiod.
Affected version
Your cluster is impacted if ALL of following conditions are true:
- It is using Istio 1.10.0 to 1.10.1, Istio 1.9.0 to 1.9.5 or Istio 1.8.x.
- It has defined
Gateways
orDestinationRules
with thecredentialName
field specified.- It does not specify the Istiod flag
PILOT_ENABLE_XDS_CACHE=false
.
Unaffected version
- Istio 1.9.6 or up, if using 1.9.x
- Istio 1.10.2 or up, if using 1.10.x
- The patch version specified by your cloud provider
If an upgrade isn’t feasible, this vulnerability can be mitigated by disabling Istiod caching. Caching is disabled by setting an Istiod environment variable
PILOT_ENABLE_XDS_CACHE=false
. System and Istiod performance may be impacted as this disables XDS caching.