Bug 1551818 (CVE-2017-1002102) - CVE-2017-1002102 kubernetes: Malicious containers can delete any file from the node
Summary: CVE-2017-1002102 kubernetes: Malicious containers can delete any file from th...
Status: CLOSED ERRATA
Alias: CVE-2017-1002102
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20180306,repor...
Keywords: Security
Depends On: 1554539 1536576 1553541 1554168 1554169 1554170 1554171 1554573
Blocks: 1536902
TreeView+ depends on / blocked
 
Reported: 2018-03-06 00:29 UTC by Jason Shepherd
Modified: 2019-07-12 13:05 UTC (History)
24 users (show)

(edit)
This vulnerability allows containers using a secret, configMap, projected, or downwardAPI volume to trigger deletion of arbitrary files and directories on the nodes where they are running. An attacker could use this flaw to delete arbitrary file or directories on node host.
Clone Of:
(edit)
Last Closed: 2019-07-12 13:05:07 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:0475 normal SHIPPED_LIVE Important: Red Hat OpenShift Container Platform security update 2018-03-12 23:40:44 UTC

Description Jason Shepherd 2018-03-06 00:29:27 UTC
A symlink race in the openShift node process allows a malicious container to trick the node into deleting any file.

Every sync iteration, the atomic writer code walks the volume looking for files that shouldn't be there or files that have changed.  When it finds files that shouldn't be there, it adds them to a list. Once it's finished walking the tree, it sorts the list lexicographically then starts at the end (to make sure that files are removed before the directories that contain them) and removes them one by one.

Because (a) the volume isn't mounted read-only by the runtime and (b) there is a time between finding the file and deleting the file, a malicious container can set up conditions to win a race such that the file to be deleted is removed and replaced with a symlink (to a node file to be deleted) between the time that the kubelet finds the file and the time it deletes it.

Comment 1 Jason Shepherd 2018-03-06 00:32:37 UTC
Acknowledgments:

Name: Joel Smith (Red Hat)

Comment 4 errata-xmlrpc 2018-03-12 19:38:43 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.3
  Red Hat OpenShift Container Platform 3.4
  Red Hat OpenShift Container Platform 3.5
  Red Hat OpenShift Container Platform 3.6
  Red Hat OpenShift Container Platform 3.7

Via RHSA-2018:0475 https://access.redhat.com/errata/RHSA-2018:0475

Comment 5 Jason Shepherd 2018-03-12 22:39:32 UTC
Created kubernetes tracking bugs for this issue:

Affects: fedora-all [bug 1554539]

Comment 6 Jason Shepherd 2018-03-13 00:21:09 UTC
Created origin tracking bugs for this issue:

Affects: fedora-all [bug 1554573]

Comment 7 Product Security DevOps Team 2019-07-12 13:05:07 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2017-1002102


Note You need to log in before you can comment on or make changes to this bug.