Amazon Vpc Cni K8S
Monthly
Namespace isolation bypass in AWS Network Policy Agent (aws-network-policy-agent) before v1.4.0 lets an authenticated, highly privileged cluster user defeat NetworkPolicy enforcement against co-located pods that live in other namespaces. The attacker must be able to create pods and control their pod and namespace names so that they generate a pod identifier that collides with the identifier of a victim pod already running on the same node, which then causes the agent to misattribute enforcement state and skip the intended isolation. Only clusters that have Network Policy enabled and run the affected agent are exposed; the vendor has released Network Policy Agent v1.4.0 and Amazon VPC CNI Managed Add-on v1.22.4 to correct the identifier scheme, and no public exploit code or confirmed active exploitation was identified at the time of analysis.
Namespace isolation bypass in AWS Network Policy Agent (aws-network-policy-agent) before v1.4.0 lets an authenticated, highly privileged cluster user defeat NetworkPolicy enforcement against co-located pods that live in other namespaces. The attacker must be able to create pods and control their pod and namespace names so that they generate a pod identifier that collides with the identifier of a victim pod already running on the same node, which then causes the agent to misattribute enforcement state and skip the intended isolation. Only clusters that have Network Policy enabled and run the affected agent are exposed; the vendor has released Network Policy Agent v1.4.0 and Amazon VPC CNI Managed Add-on v1.22.4 to correct the identifier scheme, and no public exploit code or confirmed active exploitation was identified at the time of analysis.