N\u00eb mjetin p\u00ebr ekzekutimin e kontejner\u00ebve t\u00eb izoluar runc, i p\u00ebrdorur n\u00eb Docker dhe Kubernetes, \u00ebsht\u00eb gjetur nj\u00eb dob\u00ebsi CVE-2024-21626, e cila lejon qasje n\u00eb sistemin e skedar\u00ebve t\u00eb ambientit host nga nj\u00eb kontejner i izoluar. Gjat\u00eb sulmit, nj\u00eb nd\u00ebrhyr\u00ebs mund t\u00eb ri-shkruaj\u00eb disa skedar\u00eb ekzekutiv\u00eb n\u00eb ambientin host dhe n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb t\u00eb arrij\u00eb ekzekutimin e kodit t\u00eb tij jasht\u00eb kontejnerit. N\u00eb runtime crun dhe youki, q\u00eb p\u00ebrdorin runc, si dhe n\u00eb LXC, problemi nuk shfaqet. Dob\u00ebsia \u00ebsht\u00eb riparuar n\u00eb versionin runc 1.1.12. <\/p>\n
N\u00eb rastin e p\u00ebrdorimit t\u00eb mjeteve Docker ose Kubernetes, nj\u00eb sulm mund t\u00eb b\u00ebhet p\u00ebrmes p\u00ebrgatitjes s\u00eb nj\u00eb imazhi t\u00eb ve\u00e7ant\u00eb t\u00eb kontejnerit, pas instalimit dhe nisjes s\u00eb t\u00eb cilit mund t\u00eb aksesosh sistemin e skedar\u00ebve t\u00eb jasht\u00ebm. Me p\u00ebrdorimin e Docker, ekziston mund\u00ebsia e shfryt\u00ebzimit p\u00ebrmes nj\u00eb Dockerfile t\u00eb posa\u00e7\u00ebm. Prirja gjithashtu mund t\u00eb shfryt\u00ebzohet n\u00eb rast se proceset nisen n\u00eb kontejner me komand\u00ebn 'runc exec' duke lidhur katalogun e pun\u00ebs me hap\u00ebsir\u00ebn e emrave t\u00eb mjedisit t\u00eb prit\u00ebsit. <\/p>\n
Dob\u00ebsia shkaktohet nga rrjedhja e descriptor\u00ebve t\u00eb brendsh\u00ebm t\u00eb skedar\u00ebve. Para ekzekutimit t\u00eb kodit brenda kontejnerit n\u00eb runc, mbyllen t\u00eb gjith\u00eb descriptor\u00ebt e skedar\u00ebve me ndihm\u00ebn e flagut O_CLOEXEC. Megjithat\u00eb, pas ekzekutimit t\u00eb funksionit setcwd(), mbetet nj\u00eb descriptor skedari i hapur, q\u00eb tregon n\u00eb katalogun e pun\u00ebs dhe vazhdon t\u00eb jet\u00eb i qassh\u00ebm pas ekzekutimit t\u00eb kontejnerit. Jan\u00eb propozuar disa skenar\u00eb baz\u00eb sulmi ndaj ambientit host, duke p\u00ebrdorur descriptorin e mbetur. <\/p>\n
P\u00ebr shembull, sulmuesi mund t\u00eb specifikoj\u00eb n\u00eb imazhin e kontejnerit parametrin process.cwd, q\u00eb tregon n\u00eb '\/proc\/self\/fd\/7\/', gj\u00eb q\u00eb do t\u00eb rezultoj\u00eb n\u00eb lidhjen me procesin pid1 n\u00eb kontejner me katalogun e pun\u00ebs, q\u00eb ndodhet n\u00eb hap\u00ebsir\u00ebn e montimit t\u00eb mjedisit t\u00eb prit\u00ebsit. K\u00ebshtu, n\u00eb imazhin e kontejnerit mund t\u00eb konfigurohet nisja e '\/proc\/self\/fd\/7\/..\/..\/..\/bin\/bash' dhe p\u00ebrmes ekzekutimit t\u00eb nj\u00eb skenari shell t\u00eb p\u00ebrshtatet p\u00ebrmbajtja e '\/proc\/self\/exe', e cila referon kopjen e prit\u00ebsit t\u00eb \/bin\/bash. <\/p>\n
Nj\u00eb variant tjet\u00ebr sulmi i lejon nj\u00eb sulmuesi, i cili \u00ebsht\u00eb i kufizuar brenda kontejnerit, t\u00eb aksesoj\u00eb katalogun e mjedisit t\u00eb prit\u00ebsit, n\u00ebse n\u00eb k\u00ebt\u00eb kontejner nisen procese me privilegje p\u00ebrmes komand\u00ebs 'runc exec me opsionin '--cwd'. Sulmuesi mund t\u00eb z\u00ebvend\u00ebsoj\u00eb rrug\u00ebn e procesit t\u00eb nisur me nj\u00eb lidhje simbolike, q\u00eb tregon n\u00eb '\/proc\/self\/fd\/7\/' dhe t\u00eb arrij\u00eb t\u00eb hap\u00eb '\/proc\/$exec_pid\/cwd' p\u00ebr akses n\u00eb sistemin e skedar\u00ebve n\u00eb an\u00ebn e prit\u00ebsit. Sulmuesi gjithashtu mund t\u00eb arrij\u00eb t\u00eb p\u00ebrdit\u00ebsoj\u00eb skedar\u00ebt ekzekutues n\u00eb an\u00ebn e mjedisit t\u00eb prit\u00ebsit, duke organizuar nisjen e nj\u00eb skedari ekzekutiv nga mjedisi i prit\u00ebsit ('\/proc\/self\/fd\/7\/..\/..\/..\/bin\/bash') me p\u00ebrdit\u00ebsimin e m\u00ebpastajm\u00eb t\u00eb skedarit '\/proc\/$pid\/exe', i cili referon skedarin e nisur. <\/p>\n
P\u00ebr m\u00eb tep\u00ebr, n\u00eb komponent\u00ebt e mjetit Docker jan\u00eb zbuluar gjithsej pes\u00eb vulnerabilitete: <\/p>\n