A runc vulnerability, used in Docker and Kubernetes for running isolated containers, has been discovered (CVE-2024-21626), allowing access to the host environment's filesystem from an isolated container. During the attack, an attacker can overwrite certain executable files in the host environment and thus execute their code outside the container. The issue does not manifest in the crun and youki runtimes, which use runc, or in LXC. The vulnerability has been fixed in runc version 1.1.12. <\/p>\n
Ha Docker vagy Kubernetes eszk\u00f6z\u00f6ket haszn\u00e1lnak, a t\u00e1mad\u00e1s v\u00e9grehajthat\u00f3 egy speci\u00e1lisan l\u00e9trehozott kont\u00e9nerk\u00e9p elk\u00e9sz\u00edt\u00e9s\u00e9vel, amelyet a telep\u00edt\u00e9s \u00e9s ind\u00edt\u00e1s ut\u00e1n a kont\u00e9nerb\u0151l lehet el\u00e9rni a k\u00fcls\u0151 f\u00e1jlrendszert. Docker haszn\u00e1lata eset\u00e9n a t\u00e1mad\u00e1s lehet\u0151s\u00e9ge fenn\u00e1ll egy speci\u00e1lis Dockerfile-on kereszt\u00fcl. A s\u00e9r\u00fcl\u00e9kenys\u00e9g akkor is kihaszn\u00e1lhat\u00f3, ha a kont\u00e9nerben a folyamatokat a «runc exec» parancs seg\u00edts\u00e9g\u00e9vel ind\u00edtj\u00e1k, a munkak\u00f6nyvt\u00e1r az \u0151s k\u00f6rnyezeti n\u00e9vt\u00e9rhez van k\u00f6tve. <\/p>\n
The vulnerability is caused by a leak of internal file descriptors. Before running code inside the container, runc closes all file descriptors using the O_CLOEXEC flag. However, after the subsequent execution of the setcwd() function, a file descriptor remains open that points to the working directory, continuing to be accessible after the container is launched. Several basic attack scenarios on the host environment have been proposed using the leftover file descriptor. <\/p>\n
P\u00e9ld\u00e1ul a t\u00e1mad\u00f3 a kont\u00e9nerk\u00e9pben megadhatja a process.cwd param\u00e9tert, amely a « \/proc\/self\/fd\/7\/ » -ra mutat, ami a pid1 folyamat munkak\u00f6nyvt\u00e1r\u00e1nak a gazda k\u00f6rnyezet\u00e9nek mount pontj\u00e1hoz val\u00f3 k\u00f6t\u00e9s\u00e9t eredm\u00e9nyezi. \u00cdgy a kont\u00e9nerk\u00e9pben be\u00e1ll\u00edthat\u00f3 a « \/proc\/self\/fd\/7\/..\/..\/..\/..\/bin\/bash » ind\u00edt\u00e1sa, \u00e9s egy shell script futtat\u00e1s\u00e1val fel\u00fcl\u00edrhatja a « \/proc\/self\/exe » tartalm\u00e1t, amely a gazda m\u00e1solat\u00e1ra mutat, amely a \/bin\/bash. <\/p>\n
Egy m\u00e1sik t\u00e1mad\u00e1si lehet\u0151s\u00e9g lehet\u0151v\u00e9 teszi, hogy a kont\u00e9nerben korl\u00e1tozott t\u00e1mad\u00f3 hozz\u00e1f\u00e9rjen a gazda k\u00f6rnyezet k\u00f6nyvt\u00e1r\u00e1hoz, ha a megadott kont\u00e9nerben privilegiz\u00e1lt folyamatokat ind\u00edtanak a «runc exec « --cwd » parancs haszn\u00e1lat\u00e1val. A t\u00e1mad\u00f3 a v\u00e9grehajtand\u00f3 folyamat el\u00e9r\u00e9si \u00fatj\u00e1t egy szimbolikus hivatkoz\u00e1sra cser\u00e9lheti, amely a « \/proc\/self\/fd\/7\/ » -ra mutat, \u00e9s \u00edgy megnyithatja a « \/proc\/$exec_pid\/cwd » -t a gazda f\u00e1jlrendszerhez val\u00f3 hozz\u00e1f\u00e9r\u00e9shez. A t\u00e1mad\u00f3 tov\u00e1bb\u00e1 el\u00e9rheti a v\u00e9grehajthat\u00f3 f\u00e1jlok fel\u00fcl\u00edr\u00e1s\u00e1t a gazda k\u00f6rnyezet\u00e9ben egy v\u00e9grehajthat\u00f3 f\u00e1jl elind\u00edt\u00e1s\u00e1val a gazda k\u00f6rnyezet\u00e9b\u0151l (« \/proc\/self\/fd\/7\/..\/..\/..\/..\/bin\/bash »), majd a « \/proc\/$pid\/exe » f\u00e1jl fel\u00fcl\u00edr\u00e1s\u00e1val, amely a fut\u00f3 f\u00e1jlra mutat. <\/p>\n
Tov\u00e1bb\u00e1, a Docker eszk\u00f6zk\u00e9szlet\u00e9ben \u00f6t \u00fajabb sebezhet\u0151s\u00e9get tal\u00e1ltak: <\/p>\n