4 ms·
So from a reading of the advisory and pull request, this seems to affect a specific set of scenarios, where a malicious image is running (attacker has gained ac
by raesene9 7y ago
So from a reading of the advisory and pull request, this seems to affect a specific set of scenarios, where a malicious image is running (attacker has gained access either to the running container, or compromised the image before distribution) and then a process goes to copy data out of the running container (for example by using docker cp).
Not sure if there are other scenarios where this would hit as well.
One to be aware of, but as with most vulnerabilities, good to understand how it can be exploited, when you're assessing mitigations...
- chatmasta 7y agoMany services allow uploading arbitrary images. This is certainly a threat they should mitigate against in their sandboxing strategies.
- rtempaccount1 7y agoWould an arbitrary image upload alone allow exploitation of this, or would it require an operation on the host along the lines of a 'docker cp' as well?
- chatmasta 7y agoI’m not entirely sure, as I could only read 50% of the article’s text on my mobile phone...
- cpuguy83 7y agoNo, the vulnerability is within the API for `docker cp`, specifically.
- cyphar 7y agoThe only currently known and exploitable API is with `docker cp`, but FollowSymlinkInScope is used all over the place. Unfortunately, fixing FollowSymlinkInScope requires redesigning the API and then redesigning all the callers so they stop passing around path strings blindly and instead pass around handles (which are O_PATH fds). But, as I mentioned in TFA, the plan is to rework https://github.com/cyphar/filepath-securejoin https://github.com/cyphar/filepath-securejoin to have a sane API that detects attacks on older kernels while using the new kernel bits (once merged).