The dangerous Linux privilege escalation flaw dubbed Dirty Pipe that was recently disclosed could also impact applications and systems that use containerization through tools such as Docker, researchers warn. This follows a different privilege escalation vulnerability that was patched last week and could lead to container escapes.
Dirty Pipe “could enable an attacker to effectively modify containers that are running against a shared image, or to poison an image on a host so that new containers would receive modified files,” said researcher Rory McCune from cloud security firm Aqua Security. a blog post.
What is Dirty Pipe?
The Dirty Pipe vulnerability, tracked as CVE-2022-0847, is located in the messaging pipeline or pipe of the Linux kernel. This is an inter-process communication mechanism through which one process can send data to another process. A process can open a pipe and write data to it. The kernel will store it in a buffer and then wait for a different process to read it from there.
Max Kellermann, a developer with a software company called CM4all, discovered the flaw while investigating file corruption reports from users of an HTTP server he developed. After he eliminated all possible cases in his own software, the investigation led him to the Linux kernel where he found a commit that was included in kernel 5.8 that unintentionally changed the behavior of the pipe mechanism in a way that generated such corruptions by appending arbitrary data. to the pipe from the memory buffer.
It turns out this issue can be exploited in a controlled manner to inject arbitrary data and write to or modify files that shouldn’t be accessible to the user opening the pipe, such as read-only files.
“When I realized what the real problem was, I was able to widen the hole by a large margin: It is possible to overwrite the page cache even in the absence of writers, with no timing constraints, at (almost) arbitrary positions with arbitrary. data, “Kellermann said in his advisory.
Kellermann posted a proof-of-concept exploit of how a read-only file can be overwritten with this bug, which is similar in impact to another vulnerability discovered in 2016 in the Linux copy-on-write mechanism and dubbed Dirty COW. Other researchers took the exploit further and demonstrated how it could easily be used to modify protected files and gain root rights, the highest possible privilege on Linux systems.
The flaw impacts all Linux-based systems that use a kernel version newer than 5.8, including Android. All distributions and Google have released patches, which should be installed as soon as possible. The vulnerability is rated high severity but can be particularly dangerous on systems such as shared web hosting servers where many customers have low-privileged accounts and shell access.
Dirty Pipe danger to containers
Linux containers are powerful and allow the isolation of applications from the host system without using hypervisor-based virtualization. One core feature of such container systems is the use of one read-only base image (file system) to spin up multiple containers that then use overlay filesystems to store any changes made to those particular containers. The original image that is the base for all containers should remain untouched.
According to McCune, the Dirty Pipe exploit allows attackers to violate that security guarantee because they can make changes to the base image from inside a container. This will impact all other containers that are started from the same image.
“This exploit can affect existing containers, too,” McCune said. “For example, if you had a host with 10 nginx containers using a shared image, and the attacker modified the nginx.conf file in one, it would instantly change the files in the others, too, as long as they were still using the file from the underlying image. “
Additionally, container systems allow the mounting of file system volumes from the host system as read only. By exploiting Dirty Pipe, attackers with access to a container would gain the ability to modify data from those read-only mounts.
Another privilege vulnerability patched last week, CVE-2022-0492, affects control groups (cgroups), a fundamental building block of containers. Exploitation of this vulnerability can lead to a container escape on systems that do not use additional security hardening such as AppArmor, SELinux or Seccomp.
“While Docker will default to enable AppArmor and sequence, Kubernetes disabled the default sequence profile,” McCune said in a separate analysis. “So, for Kubernetes, this must be re-enabled in each workload or at the cluster level using mutating admission controllers such as OPA Gatekeeper or Kyverno.”
Copyright © 2022 IDG Communications, Inc.
