5 ms·

Libcontainer: Insecure handling of bind mount sources

51 points by arkadiyt 5y ago

tyingq 5y ago
I bet there's now a bunch of trawling popular golang repos for: [0] == '\0' or similar.
- TheDong 5y ago
  > trawling popular golang repos for: [0] == '\0' You may have misunderstood the code you read. if (mountsources[0] == '\0') { mountsources++; continue; } That portion of code is in C, not Go, so trawling most go repos for it won't help a bit. The bug here is that data is passed between Go and C in the runc codebase, and the go and C code interpret the data differently. Very few popular go repos use C programs, and even fewer in a way similar to runc (where it's not an existing mature C program being called or linked against, but rather hacking up their own C program that talks some internal hand-rolled protocol)
  - watermelon0 5y ago
    What would be the reason to even use hand-rolled protocol instead of something commonly used, such as JSON or protobuf, which have properly tested C libraries with decent security record? I assume performance is not a problem, since it's only exchanging a small amount of data, so maybe they were aiming for the fact that less code means smaller attack surface?
    - nicoburns 5y ago
      > What would be the reason to even use hand-rolled protocol instead of something commonly used, such as JSON or protobuf, which have properly tested C libraries with decent security record? Welcome to C culture, where external libraries are to be avoided at all costs.
raesene9 5y ago
Container volume mounting has been a source of quite a few CVEs recently. CVE-2021-30465 in runc (https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r https://github.com/opencontainers/runc/security/advisories/G...) and CVE-2021-25741 in the Kubernetes kubelet (https://security.googleblog.com/2021/12/exploring-container-security-storage.html?m=1 https://security.googleblog.com/2021/12/exploring-container-...) being two examples.

5 ms·

Libcontainer: Insecure handling of bind mount sources

51 points by arkadiyt 5y ago

tyingq 5y ago
I bet there's now a bunch of trawling popular golang repos for: [0] == '\0' or similar.
- TheDong 5y ago
  > trawling popular golang repos for: [0] == '\0' You may have misunderstood the code you read. if (mountsources[0] == '\0') { mountsources++; continue; } That portion of code is in C, not Go, so trawling most go repos for it won't help a bit. The bug here is that data is passed between Go and C in the runc codebase, and the go and C code interpret the data differently. Very few popular go repos use C programs, and even fewer in a way similar to runc (where it's not an existing mature C program being called or linked against, but rather hacking up their own C program that talks some internal hand-rolled protocol)
  - watermelon0 5y ago
    What would be the reason to even use hand-rolled protocol instead of something commonly used, such as JSON or protobuf, which have properly tested C libraries with decent security record? I assume performance is not a problem, since it's only exchanging a small amount of data, so maybe they were aiming for the fact that less code means smaller attack surface?
    - nicoburns 5y ago
      > What would be the reason to even use hand-rolled protocol instead of something commonly used, such as JSON or protobuf, which have properly tested C libraries with decent security record? Welcome to C culture, where external libraries are to be avoided at all costs.
raesene9 5y ago
Container volume mounting has been a source of quite a few CVEs recently. CVE-2021-30465 in runc (https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r https://github.com/opencontainers/runc/security/advisories/G...) and CVE-2021-25741 in the Kubernetes kubelet (https://security.googleblog.com/2021/12/exploring-container-security-storage.html?m=1 https://security.googleblog.com/2021/12/exploring-container-...) being two examples.