Bug 1562246 (CVE-2018-1102)
| Summary: | CVE-2018-1102 source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | abhgupta, ahardin, bleanhar, bparees, ccoleman, dbaker, dedgar, dmoppert, eparis, grocha, hhorak, jechoi, jgoulding, jliggitt, jokerman, jorton, jupierce, kseifried, lrock, mchappel, security-response-team, smunilla, sthangav, thrcka, tjay, trankin, wzheng, xtian |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-05-17 15:43:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1563883, 1563884, 1563885, 1563886, 1563887, 1563941, 1564032, 1564282, 1568135, 1568418, 1568419, 1654243, 1654244 | ||
| Bug Blocks: | 1562249 | ||
|
Description
Pedro Sampaio
2018-03-29 21:19:33 UTC
The source-to-image (S2I/STI) builder in OpenShift 3.4-3.9 contains a vulnerability allowing an attacker to gain root access on the host system. The underlying cause is comparable to an issue in Kubernetes' kubectl (and "oc") which was reported publicly on the 25th March 2018 [1]. [1] https://github.com/kubernetes/kubernetes/issues/61297 OpenShift contains similar code as part of its S2I module, specifically in "openshift/source-to-image/pkg/tar/tar.go:ExtractTarStreamFromTarReader". Paths from a tar archive are used as input to "filepath.Join" without further sanitation. "ExtractTarStreamFromTarReader" is also used on the client side by "oc rsync". S2I uses the code to unpack artifacts in its main container. Some observations: *Flaw is not in the GO tar implementation but is in the failure to restrict the execution context. The writing is done by a process with inflated privileges. S2I in general has too many privileges for a service that processes Turing complete user input. * Major area of concern is within S2I, but other affected areas are known to exist. Acknowledgments: Name: Michael Hanselmann (hansmi.ch) External References: https://access.redhat.com/security/vulnerabilities/3422241 Mitigation: Customers can turn off the source-to-image (S2I) build strategy to prevent access to the exploitable function. Information about how to disable the source-to-image build strategy is in the product documentation. * Disabling S2I in OpenShift Enterprise 3.0 - https://docs.openshift.com/enterprise/3.0/admin_guide/securing_builds.html#disabling-a-build-strategy-globally * Disabling S2I in OpenShift Enterprise 3.1 - https://docs.openshift.com/enterprise/3.1/admin_guide/securing_builds.html#disabling-a-build-strategy-globally * Disabling S2I in OpenShift Enterprise 3.2 - https://docs.openshift.com/enterprise/3.2/admin_guide/securing_builds.html#disabling-a-build-strategy-globally * Disabling S2I in OpenShift Enterprise 3.3 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.3/html/cluster_administration/admin-guide-securing-builds * Disabling S2I in OpenShift Enterprise 3.4 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.4/html/cluster_administration/admin-guide-securing-builds * Disabling S2I in OpenShift Enterprise 3.5 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.5/html/cluster_administration/admin-guide-securing-builds * Disabling S2I in OpenShift Enterprise 3.6 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.6/html/cluster_administration/admin-guide-securing-builds * Disabling S2I in OpenShift Enterprise 3.7 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.7/html/cluster_administration/admin-guide-securing-builds * OpenShift Enterprise 3.8 is not a production version (only for upgrades). * Disabling S2I in OpenShift Enterprise 3.9 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.9/html/cluster_administration/admin-guide-securing-builds This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.9 Via RHSA-2018:1227 https://access.redhat.com/errata/RHSA-2018:1227 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.8 Via RHSA-2018:1229 https://access.redhat.com/errata/RHSA-2018:1229 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.7 Via RHSA-2018:1231 https://access.redhat.com/errata/RHSA-2018:1231 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.3 Via RHSA-2018:1239 https://access.redhat.com/errata/RHSA-2018:1239 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.2 Via RHSA-2018:1241 https://access.redhat.com/errata/RHSA-2018:1241 This issue has been addressed in the following products: Red Hat OpenShift Enterprise 3.1 Via RHSA-2018:1243 https://access.redhat.com/errata/RHSA-2018:1243 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.6 Via RHSA-2018:1233 https://access.redhat.com/errata/RHSA-2018:1233 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.5 Via RHSA-2018:1235 https://access.redhat.com/errata/RHSA-2018:1235 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.4 Via RHSA-2018:1237 https://access.redhat.com/errata/RHSA-2018:1237 OpenShift Origin commit: https://github.com/openshift/origin/commit/feca06be8b5a70d10d62a81938808e9afcaed372 Statement: Package source-to-image as shipped in Red Hat Software Collections has been rated as Important, because it allows an attacker to get access to the victim's machine, but it requires user interaction. source-to-image upstream commit: https://github.com/openshift/source-to-image/commit/f5cbcbc5cc6f8cc2f479a7302443bea407a700cb This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:0036 https://access.redhat.com/errata/RHSA-2019:0036 |