CVE-2021-34824: Istio sensitive information vulnerability alert

by ddos · June 28, 2021

Istio is an open-source service mesh that layers transparently onto existing distributed applications. Istio’s powerful features provide a uniform and more efficient way to secure, connect, and monitor services. Istio is the path to load balancing, service-to-service authentication, and monitoring – with few or no service code changes.

On June 24, 2021, Istio issued a risk notice of SECURITY-2021-007, the vulnerability number is CVE-2021-34824 with a CVSS score of 9.1. Istio contains a remotely exploitable vulnerability. Machines in the k8s cluster using Istio may be unauthorized access to the TLS certificate and key by an attacker, and take over the k8s cluster.

Vulnerability Detail

The Istio Gateway and DestinationRule can load private keys and certificates from Kubernetes secrets via the credentialName configuration. For Istio 1.8 and above, the secrets are conveyed from Istiod to gateways or workloads via the XDS API.

In the above approach, a gateway or workload deployment should only be able to access credentials (TLS certificates and private keys) stored in the Kubernetes secrets within its namespace. However, a bug in Istiod permits an authorized client the ability to access and retrieve any TLS certificate and private key cached in Istiod.

Affected version

Your cluster is impacted if ALL of following conditions are true:

It is using Istio 1.10.0 to 1.10.1, Istio 1.9.0 to 1.9.5 or Istio 1.8.x.

It has defined Gateways or DestinationRules with the credentialName field specified.

It does not specify the Istiod flag PILOT_ENABLE_XDS_CACHE=false.

Unaffected version

Istio 1.9.6 or up, if using 1.9.x

Istio 1.10.2 or up, if using 1.10.x

The patch version specified by your cloud provider

If an upgrade isn’t feasible, this vulnerability can be mitigated by disabling Istiod caching. Caching is disabled by setting an Istiod environment variable PILOT_ENABLE_XDS_CACHE=false. System and Istiod performance may be impacted as this disables XDS caching.

In this regard, we recommend that users upgrade Istio to the latest version in time.