Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
aws/amazon-vpc-cni-k8s
master @ 6bf7ade
6
Fixes
0
CVEs
HIGH
Peak severity
83.3%
Coverage
Highlights
Dependency Vulnerability: 3 prior fixes. Scrutinize any change in this area.
Makefile: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Privilege Escalation: The gRPC server was accessible to unauthorized hostNetwork pods, allowing them to invoke DelNetwork and manipulate network state. The fix moved to a Unix socket with 0660 permissions and scrubbed sensitive data, but any alternate API or introspection path may still expose similar operations.
Security Group Misconfiguration: RefreshCustomSGIDs overwrote security groups when custom networking was enabled, breaking intended isolation. The fix gates on !useCustomNetworking, but sibling code paths that refresh or apply SGs (e.g., during node init or ENI attachment) may not enforce the same gate.
Dependency Vulnerability: Bundled CNI plugin binaries were updated twice (v1.7.1->v1.9.0, v1.9.0->v1.9.1) to fix CVEs. The Makefile FETCH_VERSION is the single source, but other build targets or release pipelines may still pull older versions.