{"id":103483,"date":"2022-03-06T15:36:45","date_gmt":"2022-03-06T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera"},"modified":"2022-03-06T15:36:45","modified_gmt":"2022-03-06T13:36:47","slug":"uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-cgroups-v1-pozvolyayushhaya-vyjti-iz-izolirovannogo-kontejnera","title":{"rendered":"Cenueshm\u00ebria n\u00eb cgroups v1, e cila lejon daljen nga nj\u00eb konteiner t\u00eb izoluar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Jan\u00eb zbuluar detajet e nj\u00eb dob\u00ebsie (CVE-2022-0492) n\u00eb implementimin e mekanizmit t\u00eb kufizimit t\u00eb burimeve cgroups v1 n\u00eb b\u00ebrtham\u00ebn Linux, e cila mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb dal\u00eb nga kontejner\u00ebt e izoluara. Problemi shfaqet q\u00eb nga b\u00ebrthama Linux 2.6.24 dhe \u00ebsht\u00eb rregulluar n\u00eb publikimet e b\u00ebrtham\u00ebs 5.16.12, 5.15.26, 5.10.97, 5.4.177, 4.19.229, 4.14.266 dhe 4.9.301. Nd\u00ebrsa p\u00ebr t\u00eb ndjekur publikimet e azhurnimeve t\u00eb paketave n\u00eb shp\u00ebrndarjet, mund t\u00eb vizitoni k\u00ebto faqe: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux. <\/p>\n
Dob\u00ebsia \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim logjik n\u00eb p\u00ebrpunuesin e skedar\u00ebve release_agent, i cili nuk kryente kontrollin e duhur kur aktivizohej p\u00ebrpunuesi me nj\u00eb set t\u00eb plot\u00eb t\u00eb privilegjeve. Skedari release_agent p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrcaktuar programin q\u00eb ekzekutohet nga b\u00ebrthama kur p\u00ebrfundon nj\u00eb proces n\u00eb cgroup. Ky program \u00ebsht\u00eb aktivizuar me t\u00eb drejtat root dhe me t\u00eb gjitha 'capabilities' n\u00eb hap\u00ebsir\u00ebn kryesore t\u00eb emrave. Ishte supozuar se vet\u00ebm administratori ka akses n\u00eb konfigurimin e release_agent, por n\u00eb t\u00eb v\u00ebrtet\u00eb, kontrollet ishin t\u00eb kufizuara n\u00eb ofrimin e aksesit p\u00ebr p\u00ebrdoruesin root, i cili nuk p\u00ebrjashtonte ndryshimin e konfigurimit nga nj\u00eb kontejner ose nga p\u00ebrdoruesi root pa t\u00eb drejtat e administratorit (CAP_SYS_ADMIN). <\/p>\n
M\u00eb par\u00eb, nj\u00eb karakteristik\u00eb e till\u00eb nuk do t\u00eb merrej si nj\u00eb dob\u00ebsi, por situata ndryshoi me shfaqjen e hap\u00ebsirave t\u00eb emrave t\u00eb identifikuesve t\u00eb p\u00ebrdoruesve (user namespaces), t\u00eb cilat lejojn\u00eb krijimin e p\u00ebrdoruesve root t\u00eb ve\u00e7ant\u00eb n\u00eb kontejner\u00eb, pa u nd\u00ebrprer\u00eb me p\u00ebrdoruesin root t\u00eb mjedisit kryesor. P\u00ebr pasoj\u00eb, p\u00ebr t\u00eb sulmuar mjafton q\u00eb n\u00eb nj\u00eb kontejner, i cili ka p\u00ebr p\u00ebrdorues root nj\u00eb hap\u00ebsir\u00eb identifikuesish t\u00eb ve\u00e7ant\u00eb, t\u00eb lidh\u00eb p\u00ebrpunuesin e vet release_agent, i cili pas p\u00ebrfundimit t\u00eb procesit do t\u00eb ekzekutohet me privilegje t\u00eb plota t\u00eb mjedisit kryesor. <\/p>\n
N\u00eb m\u00ebnyr\u00eb q\u00eb cgroupfs t\u00eb montuar n\u00eb kontejner \u00ebsht\u00eb me leje vet\u00ebm p\u00ebr lexim, por nuk ka problem ta rimontoni k\u00ebt\u00eb pseudoFS n\u00eb m\u00ebnyr\u00eb shkrimi n\u00ebse keni t\u00eb drejtat CAP_SYS_ADMIN ose p\u00ebrmes krijimit me ndihm\u00ebn e thirrjes sistemike unshare t\u00eb nj\u00eb kontejneri t\u00eb brendsh\u00ebm me nj\u00eb hap\u00ebsir\u00eb t\u00eb ve\u00e7ant\u00eb t\u00eb p\u00ebrdoruesve, n\u00eb t\u00eb cilin p\u00ebr kontejnerin e krijuar jan\u00eb n\u00eb dispozicion t\u00eb drejtat CAP_SYS_ADMIN.
<\/center> <\/p>\n
Sulmi mund t\u00eb kryhet n\u00ebse ka privilegje root n\u00eb nj\u00eb konteiner t\u00eb izoluar ose kur konteineri startohet pa flamurin no_new_privs, i cili ndalon fitimin e privilegjeve t\u00eb tjera. N\u00eb sistem duhet t\u00eb aktivizohet mb\u00ebshtetje p\u00ebr hap\u00ebsirat e p\u00ebrdoruesit (\u00e7\u00ebshtja \u00ebsht\u00eb aktivizuar n\u00eb Ubuntu dhe Fedora, por jo n\u00eb Debian dhe RHEL) dhe duhet t\u00eb ket\u00eb qasje n\u00eb cgroup v1 rr\u00ebnj\u00ebsor (p.sh., Docker fillon konteiner\u00ebt n\u00eb cgroup-in rr\u00ebnj\u00ebsor RDMA). Sulmi \u00ebsht\u00eb gjithashtu i mundur n\u00ebse ka privilegje CAP_SYS_ADMIN, n\u00eb k\u00ebt\u00eb rast mb\u00ebshtetje p\u00ebr hap\u00ebsirat e p\u00ebrdoruesit dhe qasje n\u00eb hierarkin\u00eb rr\u00ebnj\u00ebsore t\u00eb cgroup v1 nuk \u00ebsht\u00eb e nevojshme. <\/p>\n
P\u00ebrve\u00e7 daljes nga kontejneri i izoluar, dob\u00ebsia gjithashtu u lejon proceseve t\u00eb aktivizuara nga p\u00ebrdoruesi root pa 'capabilities' ose \u00e7far\u00ebdo p\u00ebrdoruesi me t\u00eb drejta CAP_DAC_OVERRIDE (p\u00ebr sulmin k\u00ebrkohet akses n\u00eb skedarin \/sys\/fs\/cgroup\/*\/release_agent, i cili i p\u00ebrket root), t\u00eb ken\u00eb akses n\u00eb t\u00eb gjitha 'capabilities' sistemike. <\/p>\n
![\"Cenueshm\u00ebria](\"\/wp-content\/uploads\/2022\/03\/710b37582c444cc4be7d6ae4695c8afe.jpg\")
<\/center> <\/p>\n