{"id":103483,"date":"2022-03-06T15:36:45","date_gmt":"2022-03-06T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera"},"modified":"2022-03-06T15:36:45","modified_gmt":"2022-03-06T13:36:47","slug":"uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","title":{"rendered":"O vulnerabilitate \u00een cgroups v1, care permite ie\u0219irea dintr-un container izolat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Detalii despre vulnerabilitatea (CVE-2022-0492) din implementarea mecanismului de limitare a resurselor cgroups v1 \u00een nucleul Linux au fost dezv\u0103luite. Aceasta poate fi utilizat\u0103 pentru a ie\u0219i din containerele izolate. Problema apare \u00eencep\u00e2nd cu nucleul Linux 2.6.24 \u0219i a fost remediat\u0103 \u00een versiunile nucleului 5.16.12, 5.15.26, 5.10.97, 5.4.177, 4.19.229, 4.14.266 \u0219i 4.9.301. Pute\u021bi urm\u0103ri publicarea actualiz\u0103rilor pachetelor \u00een distribu\u021bii pe aceste pagini: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de o eroare logic\u0103 \u00een handler-ul fi\u0219ierelor release_agent, care a dus la nereguli \u00een verific\u0103rile efectuate la lansarea handler-ului cu un set complet de privilegii. Fi\u0219ierul release_agent este folosit pentru a determina programul ce va fi executat de kernel la finalizarea procesului din cgroup. Acest program este lansat cu privilegii de root \u0219i cu toate \"capabilities\" \u00een spa\u021biul de nume root. Se presupunea c\u0103 accesul la configurarea release_agent este rezervat doar administratorului, \u00eens\u0103, \u00een realitate, verific\u0103rile s-au limitat la oferirea accesului utilizatorului root, ceea ce nu excludea modificarea set\u0103rii dintr-un container sau de c\u0103tre un utilizator root f\u0103r\u0103 privilegii de administrator (CAP_SYS_ADMIN). <\/p>\n

\u00cen trecut, o asemenea particularitate nu ar fi fost perceput\u0103 ca o vulnerabilitate, dar situa\u021bia s-a schimbat odat\u0103 cu apari\u021bia spa\u021biilor de nume pentru identificarea utilizatorilor (user namespaces), care permit crearea de utilizatori root separa\u021bi \u00een containere, f\u0103r\u0103 a se suprapune cu utilizatorul root al mediului principal. Prin urmare, pentru a lansa un atac, este suficient ca \u00een containerul cu un utilizator root \u00eentr-un spa\u021biu de identificare utilizatori separat s\u0103 se conecteze propriul handler release_agent, care va fi executat cu privilegii complete \u00een mediul principal la finalizarea procesului. <\/p>\n

\u00cen mod implicit, cgroupfs este montat \u00een container \u00een modul doar pentru citire, dar nu sunt probleme \u00een a remonta acest pseudo-fs \u00een modul scriere dac\u0103 exist\u0103 privilegii CAP_SYS_ADMIN sau prin crearea, cu apelul sistemului unshare, a unui container imersat cu un spa\u021biu de nume utilizatori separat, \u00een care sunt disponibile privilegii CAP_SYS_ADMIN pentru containerul creat.

\"O<\/center> <\/p>\n

Atacul poate fi realizat \u00een prezen\u021ba privilegiilor root \u00eentr-un container izolat sau atunci c\u00e2nd containerul este lansat f\u0103r\u0103 flagul no_new_privs, care interzice ob\u021binerea de privilegii suplimentare. Suportul pentru namespaces de utilizator trebuie s\u0103 fie activat \u00een sistem (implicit activat \u00een Ubuntu \u0219i Fedora, dar nu activat \u00een Debian \u0219i RHEL) \u0219i trebuie s\u0103 existe acces la cgroup-ul root v1 (de exemplu, Docker lanseaz\u0103 containere \u00een cgroup-ul RDMA root). Atacul este, de asemenea, posibil \u00een prezen\u021ba privilegiilor CAP_SYS_ADMIN, \u00een acest caz suportul pentru namespaces de utilizator \u0219i accesul la ierarhia cgroup-ului root v1 nu sunt necesare. <\/p>\n

Pe l\u00e2ng\u0103 ie\u0219irea din containerul izolat, vulnerabilitatea permite de asemenea proceselor lansate de utilizatorul root f\u0103r\u0103 \"capabilities\" sau oric\u0103rui utilizator cu drepturi CAP_DAC_OVERRIDE (pentru atac este necesar accesul la fi\u0219ierul \/sys\/fs\/cgroup\/*\/release_agent, care apar\u021bine root), s\u0103 ob\u021bin\u0103 acces la toate \"capabilities\" sistemului. <\/p>\n

Se remarc\u0103 faptul c\u0103 vulnerabilitatea nu poate fi exploatat\u0103 atunci c\u00e2nd se aplic\u0103 mecanismele de protec\u021bie Seccomp, AppArmor sau SELinux pentru o izolare suplimentar\u0103 a containerelor, deoarece Seccomp blocheaz\u0103 apelul de sistem unshare(), iar AppArmor \u0219i SELinux nu permit montarea cgroupfs \u00een modul scriere.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-0492) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 cgroups v1 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u044f\u0434\u0440\u0430 Linux 2.6.24 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u044f\u0434\u0440\u0430 5.16.12, 5.15.26, 5.10.97, 5.4.177, 4.19.229, 4.14.266 \u0438 4.9.301. \u041f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0437\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043d\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, SUSE, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103484,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103483","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een cgroups v1, care permite ie\u0219irea dintr-un container izolat | ProHoster","description":"Detaliile vulnerabilit\u0103\u021bii (CVE-2022-0492) \u00een implementarea mecanismului de restric\u021bionare a resurselor cgroups v1 \u00een nucleul Linux, care poate fi utilizat\u0103 pentru a ie\u0219i din containerele izolate, au fost dezv\u0103luite.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cgroups v1, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-0492) \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 cgroups v1 \u0432 \u044f\u0434\u0440\u0435 Linux, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-06T13:36:47+00:00","article:modified_time":"2022-03-06T13:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103483","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-06 13:37:31","updated":"2022-10-04 06:50:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103483","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103483"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103483\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/103484"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103483"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103483"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103483"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}