13 ms·

CVE-2015-1328: incorrect permission checks in overlayfs, Ubuntu local root

76 points by QUFB 11y ago

AaronFriel 11y ago
Does this effect the "overlay" filesystem, which I've read has been renamed from "overlayfs" to avoid ambiguity?
jMyles 11y ago
So, it looks like a (non-root) user with write access to any directory can gain root? Well, shit.
userbinator 11y ago
Is Ubuntu the only distro which is affected, or are there others? Presumably any which have overlayfs enabled will be. It is also possible to list directory contents for any directory on the system regardless of permissions That's basically a "duh" once you get root...
- jsprogrammer 11y ago
  >That's basically a "duh" once you get root... The bug/exploit is that you can do it without getting root.
  - userbinator 11y ago
    Before that sentence it says "The attached exploit gives a root shell", so I felt it was rather redundant to then say that all the directories on the system can be read.
    - bottled_poe 11y ago
      I was under the impression that the second scenario does not depend on running the binary. I have not run it so can't be sure.
    - jsprogrammer 11y ago
      Getting root shell requires additional steps. It looks like you can read any directory simply by mounting it as an overlay.
- Sanddancer 11y ago
  These are two different bugs. The first one does not check to see if it is running in a namespace before mounting the filesystems, which means a user can become "root" and then create the proper overlay filesystems and play the proper file shell games to become actual root. The second one is that it doesn't check permissions for directories, allowing a user to take a peek into places they shouldn't be allowed to peek into, leaking information about places they shouldn't be able to look into.
blorgle 11y ago
The CVE states: "Hello, this is CVE-2015-1328 which allows a local root privilege escalation in the default configuration on all currently supported versions of Ubuntu." But when I look in the /boot of a randomly picked Ubuntu 12.04 server, which has 3.2, 3.8 and 3.11 installed, only the corresponding config file for 3.2 has CONFIG_USER_NS. What happened to CONFIG_USER_NS in later kernel versions?
- regecks 11y ago
  Its enabled for me in 3.13 in 14.04.
blfr 11y ago
Aren't privilege escalation attacks pretty common? Is this one particularly bad?
- deleted 11y ago
  [deleted]
akanet 11y ago
This definitely concerns me as someone who uses Docker + Overlay for sandboxing. Anyone know which webpage to refresh regularly to check for a fix? My guess is https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1465400 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1465400, but I'm not too sure.
- justincormack 11y ago
  You can compile a new kernel with user namespaces disabled for now. Docker does not require them. Obviously do not run containers as root, or that is just as bad.
- deleted 11y ago
  [deleted]
giis 11y ago
Does this affect lxc like docker/openvz?

76 points by QUFB 11y ago

AaronFriel 11y ago

Does this effect the "overlay" filesystem, which I've read has been renamed from "overlayfs" to avoid ambiguity?

jMyles 11y ago

So, it looks like a (non-root) user with write access to any directory can gain root? Well, shit.

userbinator 11y ago

Is Ubuntu the only distro which is affected, or are there others? Presumably any which have overlayfs enabled will be. It is also possible to list directory contents for any directory on the system regardless of permissions That's basically a "duh" once you get root...

jsprogrammer 11y ago
>That's basically a "duh" once you get root... The bug/exploit is that you can do it without getting root.
- userbinator 11y ago
  Before that sentence it says "The attached exploit gives a root shell", so I felt it was rather redundant to then say that all the directories on the system can be read.
  - bottled_poe 11y ago
    I was under the impression that the second scenario does not depend on running the binary. I have not run it so can't be sure.
  - jsprogrammer 11y ago
    Getting root shell requires additional steps. It looks like you can read any directory simply by mounting it as an overlay.
Sanddancer 11y ago
These are two different bugs. The first one does not check to see if it is running in a namespace before mounting the filesystems, which means a user can become "root" and then create the proper overlay filesystems and play the proper file shell games to become actual root. The second one is that it doesn't check permissions for directories, allowing a user to take a peek into places they shouldn't be allowed to peek into, leaking information about places they shouldn't be able to look into.

blorgle 11y ago

The CVE states: "Hello, this is CVE-2015-1328 which allows a local root privilege escalation in the default configuration on all currently supported versions of Ubuntu." But when I look in the /boot of a randomly picked Ubuntu 12.04 server, which has 3.2, 3.8 and 3.11 installed, only the corresponding config file for 3.2 has CONFIG_USER_NS. What happened to CONFIG_USER_NS in later kernel versions?

regecks 11y ago
Its enabled for me in 3.13 in 14.04.

blfr 11y ago

Aren't privilege escalation attacks pretty common? Is this one particularly bad?

deleted 11y ago
[deleted]

akanet 11y ago

This definitely concerns me as someone who uses Docker + Overlay for sandboxing. Anyone know which webpage to refresh regularly to check for a fix? My guess is https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1465400 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1465400, but I'm not too sure.

justincormack 11y ago
You can compile a new kernel with user namespaces disabled for now. Docker does not require them. Obviously do not run containers as root, or that is just as bad.
deleted 11y ago
[deleted]

giis 11y ago

Does this affect lxc like docker/openvz?