Bug 1801152 (CVE-2020-1726)
| Summary: | CVE-2020-1726 podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Riccardo Schirone <rschiron> |
| Component: | vulnerability | Assignee: | Jindrich Novy <jnovy> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | aos-bugs, bbaude, bmontgom, debarshir, dwalsh, eparis, gscrivan, ikavalio, jburrell, jhonce, jligon, jnovy, jokerman, lsm5, mheon, mpatel, nstielau, qiwan, rh.container.bot, santiago, security-response-team, sponnaga, tsweeney, umohnani, vrothber |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-03-10 22:31:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1889777, 1801479, 1801480, 1801571, 1801572, 1801825 | ||
| Bug Blocks: | 1790619 | ||
|
Description
Riccardo Schirone
2020-02-10 11:26:15 UTC
Vulnerability introduced in upstream commit: https://github.com/containers/libpod/commit/997c4b56ed2121726e966afe9a102ed16ba78f93 First vulnerable upstream version is v1.6.0, which includes the above commit. Function mountNamedVolume() is responsible for copying the content of the destination volume directory from the container to the volume. The copy (and the attack) happens only the first time because it is done when vol.state.NeedsCopyUp is True, which it is only at the beginning, since that field is set to False after perfoming the copy. docker is not affected by this issue, even if it does support populating a volume using a container, as it checks whether the volume is empty before copying data from the container to the volume. Function populateVolumes() in create_unix.go of the docker code base is responsible for copying data from the container's rootfs into the volume. populateVolumes() calls CopyImagePathContent(), which in turn calls copyExistingContents() that checks whether the destination folder (the volume path) is empty or not. If the volume is not empty, the copy is not performed, thus preventing a malicious image from copying data into an existing container. Acknowledgments: Name: Tristan De Cacqueray (Red Hat) Upstream PR with fix: https://github.com/containers/libpod/pull/5168 Mitigation: If a volume needs to be attached as read-only to an untrusted container or container image, first attach it to a trusted container. Using the volume for the first time will make the attack impossible for other containers that are going to use the volume. Statement: Podman versions earlier than 1.6.0 are not affected. That includes the podman versions in OCP 4.2 and earlier. Merged into master as https://github.com/containers/libpod/commit/c140ecdc9b416ab4efd4d21d14acd63b6adbdd42 Setting to Post and assigning to Jindrich for kitting needs. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.3 Via RHSA-2020:0680 https://access.redhat.com/errata/RHSA-2020:0680 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-1726 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1650 https://access.redhat.com/errata/RHSA-2020:1650 |