ContextQMD
Back to Istio Io

ISTIO-SECURITY-2021-007

content/en/news/security/istio-security-2021-007/index.md

latest2.0 KB
Original Source

{{< security_bulletin >}}

Issue

The Istio Gateway and DestinationRule can load private keys and certificates from Kubernetes secrets via the credentialName configuration. For Istio 1.8 and above, the secrets are conveyed from Istiod to gateways or workloads via the XDS API.

In the above approach, a gateway or workload deployment should only be able to access credentials (TLS certificates and private keys) stored in the Kubernetes secrets within its namespace. However, a bug in Istiod permits an authorized client the ability to access and retrieve any TLS certificate and private key cached in Istiod.

Am I impacted?

Your cluster is impacted if ALL of following conditions are true:

  • It is using Istio 1.10.0 to 1.10.1, Istio 1.9.0 to 1.9.5 or Istio 1.8.x.
  • It has defined Gateways or DestinationRules with the credentialName field specified.
  • It does not specify the Istiod flag PILOT_ENABLE_XDS_CACHE=false.

{{< warning >}} If you are using Istio 1.8, please contact your Istio provider to check for updates. Otherwise, please upgrade to the newest patch version of Istio 1.9 or 1.10. {{< /warning >}}

Mitigation

Update your cluster to the latest supported version:

  • Istio 1.9.6 or up, if using 1.9.x
  • Istio 1.10.2 or up, if using 1.10.x
  • The patch version specified by your cloud provider

If an upgrade isn't feasible, this vulnerability can be mitigated by disabling Istiod caching. Caching is disabled by setting an Istiod environment variable PILOT_ENABLE_XDS_CACHE=false. System and Istiod performance may be impacted as this disables XDS caching.

Credit

We would like to thank the team at Sopra Banking Software (Nishant Virmani, Stephane Mercier and Antonin Nycz) as well as John Howard (Google) for reporting this issue.