{"id":103483,"date":"2022-03-06T15:36:45","date_gmt":"2022-03-06T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera"},"modified":"2022-03-06T15:36:45","modified_gmt":"2022-03-06T13:36:47","slug":"uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","title":{"rendered":"Turvaauk cgroups v1, mis v\u00f5imaldab p\u00e4\u00e4seda v\u00e4lja isoleeritud konteinerist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Rohkem teavet haavatavuse (CVE-2022-0492) kohta Linuxi tuuma cgroups v1 ressursside piirangu rakenduses, mida saab kasutada isoleeritud konteineritest v\u00e4ljumiseks. Probleem ilmus alates Linuxi tuumast 2.6.24 ja on lahendatud tuuma versioonides 5.16.12, 5.15.26, 5.10.97, 5.4.177, 4.19.229, 4.14.266 ja 4.9.301. Pakettide v\u00e4rskenduste ehk uuenduste avaldamist saab j\u00e4lgida j\u00e4rgmistel lehtedel: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. <\/p>\n

Haavatavus on p\u00f5hjustatud loogilisest veast release_agenti failide t\u00f6\u00f6tlemise moodulis, mille t\u00f5ttu ei toimunud \u00f5igeid kontrolle t\u00f6\u00f6tleja k\u00e4ivitamisel t\u00e4isteenustega. Faili release_agent kasutatakse programmi m\u00e4\u00e4ramiseks, mida tuum k\u00e4ivitab protsessi l\u00f5petamisel cgrupis. See programm k\u00e4ivitatakse root-\u00f5igustega ja k\u00f5igi \u00abcapabilities\u00bb \u00f5igustega juurruumis. Eeldati, et release_agenti seadistusele p\u00e4\u00e4seb ligi ainult administraator, kuid tegelikkuses piirnes kontrollide teostamine root-kasutaja juurdep\u00e4\u00e4suga, mis ei v\u00e4listanud seadistuse muutmist konteinerist v\u00f5i root-kasutaja poolt ilma administraatori \u00f5igusteta (CAP_SYS_ADMIN). <\/p>\n

Varem ei oleks selliseid funktsioone peetud haavatavusteks, kuid olukord on muutunud, kuna kasutaja identifikaatorite nimed (user namespaces) v\u00f5imaldavad luua konteinerites eraldi root-kasutajaid, mis ei ole seotud p\u00f5hikeskkonna root-kasutajaga. Seet\u00f5ttu piisab r\u00fcnnakuks, kui konteineris, millel on oma root-kasutaja eraldi identifikaatorite ruumis, \u00fchendada oma release_agent'i t\u00f6\u00f6tlija, mis t\u00e4idetakse protsessi l\u00f5petamise j\u00e4rel p\u00f5hikeskkonna t\u00e4ielike \u00f5igustega. <\/p>\n

Mugavalt on cgroupfs konteineris monteeritud ainult lugemisre\u017eiimis, kuid pole probleemi monteerida see pseudofailis\u00fcsteem kirjutamisre\u017eiimis, kui on olemas CAP_SYS_ADMIN \u00f5igused v\u00f5i luua kaudu s\u00fcsteemik\u00f5nes unshare sisemine konteiner koos eraldi kasutaja nimedega, kus loodud konteineri jaoks on saadaval CAP_SYS_ADMIN \u00f5igused.

\"Turvaauk<\/center> <\/p>\n

R\u00fcnnaku tegemiseks peavad olema sisemistest konteineritest root-\u00f5igused v\u00f5i tuleb konteinerit k\u00e4ivitada ilma no_new_privs-liputa, mis ei luba t\u00e4iendavate privileegide saamist. S\u00fcsteemis peab olema lubatud user namespaces tugi (kubi on vaikimisi lubatud Ubuntu ja Fedora puhul, kuid mitte aktiveeritud Debianis ja RHEL-is) ning juurdep\u00e4\u00e4s root cgroup v1-le (n\u00e4iteks Docker k\u00e4ivitab konteinerid juurese GM cgroupis). R\u00fcnnak on v\u00f5imalik ka CAP_SYS_ADMIN privileegide olemasolul, juhul ei ole user namespaces ja juurdep\u00e4\u00e4s juurehierarhiaga cgroup v1 vajalik. <\/p>\n

Lisaks isoleeritud konteinerist v\u00e4ljumisele v\u00f5imaldab haavatavus ka protsessidel, mis on k\u00e4ivitatud root-kasutaja poolt ilma \u00abcapabilities\u00bb \u00f5igusteta v\u00f5i igal kasutajal, kellel on CAP_DAC_OVERRIDE \u00f5igused (r\u00fcndamiseks on vajalik juurdep\u00e4\u00e4s failile \/sys\/fs\/cgroup\/*\/release_agent, mis kuulub root'ile), p\u00e4\u00e4seda ligi k\u00f5igile s\u00fcsteemi \u00abcapabilities\u00bb \u00f5igustele. <\/p>\n

On m\u00e4rgitud, et haavatavust ei saa \u00e4ra kasutada, kui on kasutusel kaitsemehhanismid Seccomp, AppArmor v\u00f5i SELinux, et konteinerite t\u00e4iendav isoleerimine, kuna Seccomp blokeerib juurdep\u00e4\u00e4su s\u00fcsteemi kutsumisele unshare(), AppArmor ja SELinux ei luba cgroupfs-i kirjutusre\u017eiimis mountimist.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-0492) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 cgroups v1 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u044f\u0434\u0440\u0430 Linux 2.6.24 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u044f\u0434\u0440\u0430 5.16.12, 5.15.26, 5.10.97, 5.4.177, 4.19.229, 4.14.266 \u0438 4.9.301. \u041f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, SUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103484,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cgroups v1 haavatavus, mis v\u00f5imaldab isoleeritud konteinerist v\u00e4lja minna | ProHoster","description":"L\u00f6\u00f6dud on \u00fcksikasjad haavatavuse (CVE-2022-0492) kohta, mis puudutab cgroups v1 ressursside piiramismehhanismi teostust Linuxi k\u00e4rjes, mida saab kasutada isoleeritud konteineritest v\u00e4ljap\u00e4\u00e4semiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cgroups v1, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-0492) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 cgroups v1 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-06T13:36:47+00:00","article:modified_time":"2022-03-06T13:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103483","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-06 13:37:31","updated":"2022-10-04 06:50:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103483"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/103484"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}