Containers stack vulnerabilities · Page 6

`docker cp` allows unexpected chmod of host files

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted.

• Update to 18.09.7-0ubuntu1~16.04.9+esm1
• Update to 20.10.10+dfsg1-1
• Update to 20.10.7-0ubuntu1~18.04.2
• Update to 20.10.7-0ubuntu1~20.04.2
• Update to 20.10.7-0ubuntu7

Insufficiently restricted permissions on data directory in Docker Engine

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user

• Update to 20.10.10+dfsg1-1
• Update to 20.10.7-0ubuntu5
• Update to 20.10.7-0ubuntu5~18.04.2
• Update to 20.10.7-0ubuntu5~20.04.1

Insufficiently restricted permissions on plugin directories

containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could dis

• Update to 1.2.6-0ubuntu1~16.04.6+esm2
• Update to 1.5.2-0ubuntu1~18.04.3
• Update to 1.5.2-0ubuntu1~20.04.3
• Update to 1.5.5-0ubuntu3
• Update to 1.5.7~ds1-1

Symlink Exchange Can Allow Host Filesystem Access

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.

• Update to 1.20.5+really1.20.2-1

Holes in EndpointSlice Validation Enable Host Network Hijack

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.

• Update to 1.20.5+really1.20.2-1

Webhook redirect in kube-apiserver

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

• Update to 1.20.5+really1.20.2-1

Holes in EndpointSlice Validation Enable Host Network Hijack

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.

• Update to 1.20.5+really1.20.2-1

Validating Admission Webhook does not observe some previous fields

A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields.

• Update to 1.20.5+really1.20.2-1

Archive package allows chmod of file outside of unpack target directory

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sourc

• Update to 1.2.6-0ubuntu1~16.04.6+esm2
• Update to 1.4.5~ds1-2
• Update to 1.5.2-0ubuntu1~18.04.2
• Update to 1.5.2-0ubuntu1~20.04.2

environment variable leak

In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If yo

• Update to 1.3.3-0ubuntu2.3
• Update to 1.4.4~ds1-1
• Update to 1.5.2-0ubuntu1~18.04.2

privilege escalation in Moby

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesystem they can modify files under "/var/lib/docker/<remapping>" that cause writing files with extended privileges. Versions 20.10.3 and 19.03.15 contain patches that prevent privilege escalation from remapped user.

• Update to 20.10.3+dfsg1-1
• Update to 20.10.7-0ubuntu1~18.04.1
• Update to 20.10.7-0ubuntu1~20.04.1

Docker daemon crash during image pull of malicious image

In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.

• Update to 20.10.3+dfsg1-1
• Update to 20.10.7-0ubuntu1~18.04.1
• Update to 20.10.7-0ubuntu1~20.04.1

Kubernetes man in the middle using LoadBalancer or ExternalIPs

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

• Update to 1.31.4+ds-1

Secret leaks in logs for vSphere Provider kube-controller-manager

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Docker config secrets leaked when file is malformed and loglevel >= 4

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

• Update to 1.19.3-1

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

• Update to 1.20.0-1

Ceph RBD adminSecrets exposed in logs when loglevel >= 4

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

• Update to 1.19.3-1

containerd-shim API Exposed to Host Network Containers

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed i

• Update to 1.2.6-0ubuntu1~16.04.6
• Update to 1.3.3-0ubuntu1~18.04.4
• Update to 1.3.3-0ubuntu2.2
• Update to 1.4.3~ds1-1
• Update to 20.10.0~rc1+dfsg2-1

containerd can be coerced into leaking credentials during image pull

In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public im

• Update to 1.2.6-0ubuntu1~16.04.4
• Update to 1.3.2~ds1-2
• Update to 18.09.7-0ubuntu1~16.04.6
• Update to 19.03.13+dfsg2-1
• Update to 19.03.6-0ubuntu1~18.04.2
• Update to 19.03.8-0ubuntu1.20.04.1

Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

• Update to 0.28.0