Bug 1969264 (CVE-2021-3602)

Summary: CVE-2021-3602 buildah: Host environment variables leaked in build container when using chroot isolation
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acui, adam.kaplan, amurdaca, aos-bugs, bbaude, bburky, bdettelb, bmontgom, container-sig, debarshir, dwalsh, eparis, jburrell, jligon, jnovy, jokerman, lsm5, mheon, nalin, nstielau, patrick, pehunt, pthomas, rh.container.bot, rphillips, santiago, security-response-team, sfowler, sponnaga, tomckay, tsweeney, umohnani
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: buildah 1.21.3, buildah 1.19.9, buildah 1.17.2, buildah 1.16.8 Doc Type: If docs needed, set a value
Doc Text:
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-28 02:59:42 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1972049, 1977937, 1977938, 1977939, 1977940, 1977941, 1977942, 1977943, 1977944, 1982880, 1982881    
Bug Blocks: 1968682    

Description Sam Fowler 2021-06-08 05:43:41 UTC
An information disclosure vulnerability was found in buildah, when using `buildah bud` with chroot isolation. Dockerfile RUN commands executed during rootless `buildah bud` execution can read environment variables from the host, which may include sensitive information, such as container registry credentials.

Comment 15 Sam Fowler 2021-07-15 21:44:40 UTC
Created buildah tracking bugs for this issue:

Affects: fedora-all [bug 1982880]

Created podman tracking bugs for this issue:

Affects: fedora-all [bug 1982881]

Comment 17 Fedora Update System 2021-07-23 01:03:41 UTC
FEDORA-2021-723a480816 has been pushed to the Fedora 34 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 19 errata-xmlrpc 2021-11-09 17:25:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4154 https://access.redhat.com/errata/RHSA-2021:4154

Comment 20 errata-xmlrpc 2021-11-09 17:47:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4221 https://access.redhat.com/errata/RHSA-2021:4221

Comment 21 errata-xmlrpc 2021-11-09 17:47:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4222 https://access.redhat.com/errata/RHSA-2021:4222