{"id":103483,"date":"2022-03-06T15:36:45","date_gmt":"2022-03-06T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera"},"modified":"2022-03-06T15:36:45","modified_gmt":"2022-03-06T13:36:47","slug":"uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","title":{"rendered":"Haavatavus cgroups v1, mis v\u00f5imaldab v\u00e4ljuda isoleeritud konteinerist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avastatud on haavatavuse (CVE-2022-0492) \u00fcksikasjad, mis puudutab Linuxi tuuma cgroups v1 ressursipiirangumehhanismi rakendamist. See haavatavus v\u00f5ib v\u00f5imaldada isoleeritud konteineritest v\u00e4ljuda. Probleem ilmneb alates Linuxi kernest 2.6.24 ning on k\u00f5rvaldatud kerneliversioonides 5.16.12, 5.15.26, 5.10.97, 5.4.177, 4.19.229, 4.14.266 ja 4.9.301. Pakettide v\u00e4rskenduste v\u00e4ljaandmist saab j\u00e4lgida nendel lehtedel: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. <\/p>\n

Haavatavus tuleneb loogilisest veast release_agenti failide t\u00f6\u00f6tlejas, mis p\u00f5hjustas, et n\u00f5utavaid kontrollimisi ei teostatud t\u00f6\u00f6tleja k\u00e4ivitamisel t\u00e4ie volitustega. Release_agenti faili kasutatakse programmi m\u00e4\u00e4ramiseks, mida tuum k\u00e4ivitab protsessi l\u00f5petamisel cgroupis. See programm k\u00e4ivitatakse root-i \u00f5igustega ja k\u00f5igi «capabilities»ga juurruumi nimede ruumis. Eeldati, et release_agenti seadistusele p\u00e4\u00e4seb ligi vaid administraator, kuid tegelikult piirdusid kontrollid root-kasutajale juurdep\u00e4\u00e4su andmisega, mis ei v\u00e4listanud seadistuse muutmist konteinerist v\u00f5i root-kasutaja poolt, kellel ei olnud administraatori \u00f5igusi (CAP_SYS_ADMIN). <\/p>\n

Varem ei oleks sarnast omadust peetud haavatavuseks, kuid olukord muutus koos kasutaja nimede (user namespaces) tekkega, mis v\u00f5imaldavad konteinerites luua eraldi root kasutajaid, mis ei kattuks p\u00f5hikeskkonna root kasutajaga. Seega piisab, kui konteineris, millel on oma root kasutaja eraldi kasutaja nimede ruumis, \u00fchendada oma release_agent t\u00f6\u00f6tleja, mis k\u00e4ivitatakse p\u00e4rast protsessi l\u00f5petamist p\u00f5hikeskkonna t\u00e4ielike \u00f5igustega. <\/p>\n

Vaikes\u00e4tetena on cgroupfs konteineris montaa\u017eire\u017eiimis ainult lugemiseks, kuid ei esine probleeme seda pseudos\u00fcsteemi kirjutusre\u017eiimisse remontimisel, kui on olemas \u00f5igused CAP_SYS_ADMIN v\u00f5i luues s\u00fcsteemik\u00f5nede unshare abil sissepandud konteineri koos eraldi kasutaja nimede ruumiga, kus loodud konteinerile on saadaval \u00f5igused CAP_SYS_ADMIN.

\"Haavatavus<\/center> <\/p>\n

R\u00fcnnaku saab teha, kui on olemas root-kasutaja \u00f5igused isoleeritud konteineris v\u00f5i kui konteinerit k\u00e4ivitatakse ilma no_new_privs liputa, mis keelab t\u00e4iendavate privileegide saamise. S\u00fcsteemis peab olema sisse l\u00fclitatud kasutaja nimede ruumide tugi (mis on vaikimisi lubatud Ubuntu ja Fedora puhul, kuid mitte aktiveeritud Debianis ja RHEL-is) ning juurdep\u00e4\u00e4s juurkergu cgroup v1-le (n\u00e4iteks Docker k\u00e4ivitab konteinerid juurse RDMA cgroupis). R\u00fcnnak on samuti v\u00f5imalik, kui on olemas CAP_SYS_ADMIN \u00f5igused; sel juhul ei ole kasutaja nimede ruumide tugi ja juurdep\u00e4\u00e4s juhierarhiale cgroup v1 vajalik. <\/p>\n

Lisaks isoleeritud konteinerist v\u00e4ljumisele v\u00f5imaldab haavatavus ka protsessidel, mida k\u00e4itatakse root-kasutaja poolt ilma «capabilities» v\u00f5i igal kasutajal, kellel on CAP_DAC_OVERRIDE \u00f5igused (r\u00fcnnaku teostamiseks on vajalik juurdep\u00e4\u00e4s failile \"\/sys\/fs\/cgroup\/*\/release_agent\", mis kuulub root'ile), saada juurdep\u00e4\u00e4s k\u00f5igile s\u00fcsteemi «capabilities». <\/p>\n

On m\u00e4rgatud, et haavatavust ei saa \u00e4ra kasutada, kui kasutatakse Seccomp, AppArmor v\u00f5i SELinux kaitsemehhanisme konteinerite t\u00e4iendavaks isoleerimiseks, sest Seccomp blokeerib s\u00fcsteemit\u00f5ukele unshare() juurdep\u00e4\u00e4su, ja AppArmor ja SELinux ei luba cgroupfs-i kirjutamismoodis monteerida.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-0492) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 cgroups v1 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u044f\u0434\u0440\u0430 Linux 2.6.24 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u044f\u0434\u0440\u0430 5.16.12, 5.15.26, 5.10.97, 5.4.177, 4.19.229, 4.14.266 \u0438 4.9.301. \u041f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, SUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103484,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus cgroups v1, mis v\u00f5imaldab isoleeritud konteinerist v\u00e4lja p\u00e4\u00e4seda | ProHoster","description":"On avalikustatud \u00fcksikasjad haavatavusest (CVE-2022-0492) Linuxi tuuma cgroups v1 ressursside piiramise mehhanismi rakenduses, mida saab kasutada isoleeritud konteineritest v\u00e4ljumiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cgroups v1, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-0492) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 cgroups v1 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-06T13:36:47+00:00","article:modified_time":"2022-03-06T13:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103483","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-06 13:37:31","updated":"2022-10-04 06:50:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103483"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/103484"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}