{"id":113376,"date":"2024-02-03T13:41:10","date_gmt":"2024-02-03T11:41:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-runc-pozvolyayushhaya-vybratsya-iz-kontejnerov-docker-i-kubernetes"},"modified":"2024-02-03T13:41:10","modified_gmt":"2024-02-03T11:41:10","slug":"uyazvimost-v-runc-pozvolyayushhaya-vybratsya-iz-kontejnerov-docker-i-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-runc-pozvolyayushhaya-vybratsya-iz-kontejnerov-docker-i-kubernetes","title":{"rendered":"Nj\u00eb vulnerabilitet n\u00eb runc, i cili lejon q\u00eb t\u00eb dal\u00eb nga kontejner\u00ebt Docker dhe Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb mjetin p\u00ebr ekzekutimin e kontejner\u00ebve t\u00eb izoluar runc, i p\u00ebrdorur n\u00eb Docker dhe Kubernetes, u zbulua nj\u00eb dob\u00ebsi CVE-2024-21626, e cila lejon qasje n\u00eb sistemin e skedave t\u00eb ambientit host nga nj\u00eb kontejner i izoluar. Gjat\u00eb sulmit, nj\u00eb sulmues mund t\u00eb rivendos\u00eb disa skedar\u00eb ekzekutiv\u00eb n\u00eb ambientin host dhe k\u00ebshtu t\u00eb arrij\u00eb ekzekutimin e kodit t\u00eb tij jasht\u00eb kontejnerit. N\u00eb runtime crun dhe youki, t\u00eb cilat p\u00ebrdorin runc, si dhe n\u00eb LXC, problemi nuk shfaqet. Dob\u00ebsia \u00ebsht\u00eb riparuar n\u00eb versionin runc 1.1.12. <\/p>\n
N\u00eb rastin e p\u00ebrdorimit t\u00eb mjeteve Docker ose Kubernetes, nj\u00eb sulm mund t\u00eb kryhet p\u00ebrmes p\u00ebrgatitjes s\u00eb nj\u00eb imazhi t\u00eb ve\u00e7ant\u00eb t\u00eb kontejnerit, pas instalimit dhe aktivizimit t\u00eb t\u00eb cilit, mund t\u00eb qasemi n\u00eb sistemin e dosjeve t\u00eb jashtme nga brenda kontejnerit. Duke p\u00ebrdorur Docker, ka mund\u00ebsi p\u00ebr shfryt\u00ebzim p\u00ebrmes nj\u00eb Dockerfile t\u00eb p\u00ebgatitur posa\u00e7\u00ebrisht. Po ashtu, kjo dob\u00ebsi mund t\u00eb shfryt\u00ebzohet n\u00eb rastin e ekzekutimit t\u00eb proceseve n\u00eb kontejner nga komanda «runc exec» duke lidhur katalogun e pun\u00ebs me hap\u00ebsir\u00ebn em\u00ebrtimore t\u00eb mjedisit t\u00eb hostit. <\/p>\n
Dob\u00ebsia shkaktohet nga rrjedhja e skedar\u00ebve t\u00eb brendsh\u00ebm t\u00eb descriptor\u00ebve. Para ekzekutimit t\u00eb kodit brenda kontejnerit n\u00eb runc, mbyllen t\u00eb gjith\u00eb descriptor\u00ebt e skedar\u00ebve duke p\u00ebrdorur flag-un O_CLOEXEC. Megjithat\u00eb, pas ekzekutimit t\u00eb funksionit setcwd(), mbetet nj\u00eb descriptor skedari i hapur, q\u00eb i referohet direktoris\u00eb s\u00eb pun\u00ebs dhe vazhdon t\u00eb jet\u00eb i aksesuesh\u00ebm pas ekzekutimit t\u00eb kontejnerit. Jan\u00eb propozuar disa skenar\u00eb t\u00eb thjesht\u00eb sulmi ndaj ambientit host, duke p\u00ebrdorur descriptorin e mbetur t\u00eb skedarit. <\/p>\n
P\u00ebr shembull, sulmuesi mund t\u00eb vendos\u00eb n\u00eb imazhin e kontejnerit parametrin process.cwd, i cili tregon n\u00eb «\/proc\/self\/fd\/7\/», duke \u00e7uar n\u00eb lidhjen me procesin pid1 n\u00eb kontejnerin ku ndodhet katalogu i pun\u00ebs n\u00eb hap\u00ebsir\u00ebn e montimit t\u00eb mjedisit t\u00eb hostit. K\u00ebshtu, n\u00eb imazhin e kontejnerit mund t\u00eb konfiguroni p\u00ebr t\u00eb aktivizuar «\/proc\/self\/fd\/7\/..\/..\/..\/bin\/bash» dhe p\u00ebrmes ekzekutimit t\u00eb nj\u00eb skenari shell, t\u00eb ri-shkruani p\u00ebrmbajtjen e «\/proc\/self\/exe», e cila referon kopjen e hostit t\u00eb \/bin\/bash. <\/p>\n
Nj\u00eb variant tjet\u00ebr sulmi lejon nj\u00eb sulmues t\u00eb kufizuar brenda kontejnerit t\u00eb qas\u00eb n\u00eb katalogun e mjedisit t\u00eb hostit, n\u00ebse n\u00eb kontejnerin e dh\u00ebn\u00eb aktivizohen procese me privilegje duke p\u00ebrdorur komand\u00ebn «runc exec me opsionin «—cwd». Sulmuesi mund t\u00eb d\u00ebmtoj\u00eb rrug\u00ebn e procesit q\u00eb aktivizohet duke e ndryshuar at\u00eb me nj\u00eb lidhje simbolike q\u00eb tregon n\u00eb «\/proc\/self\/fd\/7\/» dhe t\u00eb arrihet hapja e «\/proc\/$exec_pid\/cwd» p\u00ebr qasje n\u00eb sistemin e dosjeve n\u00eb an\u00ebn e hostit. Po ashtu, sulmuesi mund t\u00eb arrij\u00eb ri-shkrimin e skedar\u00ebve ekzekutiv\u00eb n\u00eb an\u00ebn e hostit p\u00ebrmes organizimit t\u00eb aktivizimit t\u00eb nj\u00eb skedari ekzekutiv nga mjedisi i hostit («\/proc\/self\/fd\/7\/..\/..\/..\/bin\/bash») dhe me ri-shkrimin e skedarit «\/proc\/$pid\/exe», i cili referon skedarin e aktivizuar. <\/p>\n