Bug 1552987 (CVE-2018-1069)

Summary: CVE-2018-1069 Networking: container networking does not prevent access to network resources
Product: [Other] Security Response Reporter: Jason Shepherd <jshepherd>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: afox, ahardin, aos-bugs, bbennett, bjarolim, bleanhar, ccoleman, dedgar, dmcphers, dmoessne, dominik.mierzejewski, hongli, jgoulding, jkeck, jokerman, jshepherd, jstrunk, mchappel
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
GlusterFS and NFS network filesystems rely on File System User ID and Group ID information in order to restrict access to file shares. However, it's possible to overwrite the Openshift restrictions on container UserId and GroupdId as they are not validated before being sent over the Openshift Network. An attacker could use the flaw to read and write any data on the network filesystem.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:17:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1553555    
Bug Blocks: 1547807    

Description Jason Shepherd 2018-03-08 01:36:38 UTC
GlusterFS and NFS network filesystems rely on File System User ID and Group ID information in order to restrict access to file shares. However it's possible to overwrite the Openshift restrictions on container UserId and GroupdId as they are not validated before being sent over the Openshift Networking. An attacker could use the flaw to read and write any data on the network filesystem.

Comment 1 Jason Shepherd 2018-03-08 01:36:49 UTC
Acknowledgments:

Name: Andreas Skoglund (Basefarm AS)

Comment 2 Jason Shepherd 2018-03-08 01:59:11 UTC
Mitigation:

Comment 4 Jason Shepherd 2018-03-08 03:25:09 UTC
Setting Openshift Enterprise 3 as WONTFIX. With the EgressNetworkPolicy mitigation in place this is not exploitable. We hope to improve the security of Openshift Enterprise Networking by implementing this feature request:

https://bugzilla.redhat.com/show_bug.cgi?id=1346466

Comment 14 Jason Shepherd 2018-06-11 23:48:40 UTC
Mitigation:

If exposing shares with NFS or GlusterFS to Openshift Nodes use EgressNetworkPolicy, [1] to redirect outbound storage network traffic via an egress router. Alternatively if you're on AWS, EgressNetworkPolicy is not supported, you can use a Static IP, [2], for projects to force projects which need storage to connect from a NIC with a unique IP Address. 

Once traffic is coming from a known IP address, not the Node IP, you can protect the NFS, or GlusterFS storage node with a firewall, or exports which only allows access from the Egress router, or from the Static IP. 

An egress policy such as the one in the redirect-mode, [3], is an example of egress policy which would mitigate this vulnerability. An administrator would need to deploy one of these to the project using storage, as they need to run in privileged mode. This forces all traffic to the storage device through the egress router, which is a distinct IP. You can then configure the storage device to only access traffic from that source IP.

Be aware that during a docker build, the build container is not subject to EgressNetworkPolicy rules in versions prior to 3.7. Also the Static IP feature is only available as a Tech Preview from version 3.7.

An alternative mitigation if you're using Red Hat Gluster Storage is outlined here: https://github.com/gluster/gluster-kubernetes/blob/master/docs/design/tls-security.md

A semi-automatic namespace wide egress-IP is due to be released in OCP 3.11 which will make management of the EgressNetworkPolicy easier. It will only work for the multitenant and networkpolicy plugins.

[1] https://docs.openshift.com/container-platform/3.7/admin_guide/managing_networking.html#admin-guide-controlling-egress-traffic

[2] https://docs.openshift.com/container-platform/3.7/admin_guide/managing_networking.html#enabling-static-ips-for-external-project-traffic

[3] https://docs.openshift.org/latest/admin_guide/managing_networking.html#admin-guide-deploying-an-egress-router-pod