{"id":34748,"date":"2019-10-31T22:00:11","date_gmt":"2019-10-31T19:00:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-docker-pozvolyayushhaya-vybratsya-iz-kontejnera\/"},"modified":"2019-10-31T22:00:11","modified_gmt":"2019-10-31T19:00:11","slug":"uyazvimost-v-docker-pozvolyayushhaya-vybratsya-iz-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-docker-pozvolyayushhaya-vybratsya-iz-kontejnera","title":{"rendered":"Vulnerabiliteet Dockeris, mis v\u00f5imaldab konteinerist v\u00e4lja p\u00e4\u00e4seda.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Isolatsiooni Linux konteinerite Docker haldust\u00f6\u00f6riistad tuvastatud<\/a><\/noindex> haavatavus (CVE-2018-15664<\/a><\/noindex>), mis teatud oludes v\u00f5imaldab p\u00e4\u00e4seda hosti keskkonda konteineri seest, kui on v\u00f5imalik s\u00fcsteemis k\u00e4ivitada oma kujundeid v\u00f5i p\u00e4\u00e4seda t\u00e4itmisele kuuluvale konteinerile. Probleem esineb k\u00f5igis Docker'i versioonides ja j\u00e4\u00e4b lahendamata (pakkumine on olemas, kuid ei ole veel vastu v\u00f5etud, pat\u0161<\/a><\/noindex>, mis peatab konteineri t\u00f6\u00f6 ajaks, kui teostatakse operatsioone FS-iga).<\/p>\n

Haavatavus v\u00f5imaldab faile konteinerist v\u00e4lja t\u00f5mmata host-s\u00fcsteemi vabasse faili s\u00fcsteemi, kui t\u00e4idetakse k\u00e4sku «docker cp». Failide v\u00e4ljav\u00f5tmine toimub root-kasutaja \u00f5igustes, mis v\u00f5imaldab lugeda v\u00f5i kirjutada igasuguseid faile host-keskkonnas, mis on piisav, et saada kontroll host-s\u00fcsteemi \u00fcle (n\u00e4iteks saab \u00fcmber kirjutada \/etc\/shadow). <\/p>\n

R\u00fcnnakut saab teostada ainult siis, kui administraator t\u00e4idab k\u00e4sku «docker cp» failide kopeerimiseks konteinerisse v\u00f5i sealt v\u00e4lja. Nii et r\u00fcndaja peab kuidagi veenma Docker'i administraatorit, et see tegevus on vajalik, ja prognoosima kopeerimisel kasutatavat teed. Teiselt poolt saab r\u00fcnnakut teostada n\u00e4iteks siis, kui pilveteenused pakuvad vahendeid konfiguratsioonifailide kopeerimiseks konteinerisse, mis on loodud kasutades k\u00e4sku «docker cp».<\/p>\n

Probleem on p\u00f5hjustatud puudulikkusest funktsiooni FollowSymlinkInScope<\/a><\/noindex>, mis arvutab absoluutse tee p\u00f5hifailis\u00fcsteemis, tuginedes suhtelisele teele, mis arvestab konteineri asukohta. K\u00e4sku «docker cp» t\u00e4ites tekib l\u00fchiajaline v\u00f5istlusolukord<\/a><\/noindex>, kus tee on juba kontrollitud, kuid operatsiooni ei ole veel teostatud. Kuna kopeerimine toimub hosti keskkonna p\u00f5hifailis\u00fcsteemi kontekstis, on antud hetkel v\u00f5imalik link muuta teiseks teeks ja algatada andmete kopeerimine failis\u00fcsteemi suvalisse kohta, mis ei pea olema konteineris.<\/p>\n

Kuna v\u00f5istlusolukorra ajavahemik on v\u00e4ga piiratud, siis valmisolekus eksplooiti protot\u00fc\u00fcp<\/a><\/noindex> failide kopeerimise operatsioonide t\u00e4itmisel \u00f5nnestus r\u00fcnnak saavutada v\u00e4hem kui 1% juhtudest, muutes s\u00fcmboolset linki kopeerimisoperatsioonis kasutataval teel (\u00f5nnestunud r\u00fcnnak toimus p\u00e4rast umbes 10 sekundi katsetuste pidevat ts\u00fcklit, et kopeerida fail k\u00e4sklusega «docker cp»).<\/p>\n

Konteinerisse kopeerimise operatsiooni t\u00e4itmisel on v\u00f5imalik saavutada korduv r\u00fcnnak faili \u00fcmberkirjutamiseks host-s\u00fcsteemis vaid m\u00f5ne iteratsiooni kaudu. R\u00fcnnaku v\u00f5imalus on seotud sellega, et konteinerisse kopeerimisel rakendatakse «chrootarchive» kontseptsiooni, mille kohaselt protsess archive.go ekstraktib arh\u00fc\u00fcvi mitte konteineri chroot-juurese, vaid sihtt tee vanemakatse chroot'i, mille \u00fcle r\u00fcndaja kontrollib ja ei peata samal ajal konteineri t\u00e4itmist (chroot'i kasutatakse vihjena v\u00f5iduolukorra \u00e4rakasutamiseks).<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 Linux-\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c\u0438 Docker \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2018-15664), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u043c \u0441\u0442\u0435\u0447\u0435\u043d\u0438\u0438 \u043e\u0431\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044e \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0441\u0432\u043e\u0438\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u043f\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 Docker \u0438 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 (\u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d, \u043d\u043e \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u0440\u0438\u043d\u044f\u0442, \u043f\u0430\u0442\u0447, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0438\u0439 \u043f\u0440\u0438\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0440\u0430\u0431\u043e\u0442\u044b \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-34748","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Docker'i haavatavus, mis v\u00f5imaldab konteinerist v\u00e4lja p\u00e4\u00e4seda | ProHoster","description":"Docker'is isoleeritud Linuxi konteinerite haldamise t\u00f6\u00f6riistades on tuvastatud haavatavus (","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-docker-pozvolyayushhaya-vybratsya-iz-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Docker, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0431\u0440\u0430\u0442\u044c\u0441\u044f \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 Linux-\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c\u0438 Docker \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-docker-pozvolyayushhaya-vybratsya-iz-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:00:11+00:00","article:modified_time":"2019-10-31T19:00:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34748","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:28:56","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:15:38","updated":"2026-01-21 20:28:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34748","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=34748"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/34748\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=34748"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=34748"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=34748"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}