Bug 1562246 (CVE-2018-1102) - CVE-2018-1102 source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go
Summary: CVE-2018-1102 source-to-image: Improper path sanitization in ExtractTarStream...
Status: CLOSED ERRATA
Alias: CVE-2018-1102
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=critical,public=20180427,repor...
Keywords: Security
Depends On: 1654244 1563883 1563884 1563885 1563886 1563887 1563941 1564032 1564282 1568135 1568418 1568419 1654243
Blocks: 1562249
TreeView+ depends on / blocked
 
Reported: 2018-03-29 21:19 UTC by Pedro Sampaio
Modified: 2019-01-08 13:44 UTC (History)
28 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-05-17 15:43:22 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1227 None None None 2018-04-28 03:36 UTC
Red Hat Product Errata RHSA-2018:1229 None None None 2018-04-28 11:56 UTC
Red Hat Product Errata RHSA-2018:1231 None None None 2018-04-29 14:36 UTC
Red Hat Product Errata RHSA-2018:1233 None None None 2018-04-30 04:00 UTC
Red Hat Product Errata RHSA-2018:1235 None None None 2018-04-30 05:01 UTC
Red Hat Product Errata RHSA-2018:1237 None None None 2018-04-30 05:26 UTC
Red Hat Product Errata RHSA-2018:1239 None None None 2018-04-29 19:39 UTC
Red Hat Product Errata RHSA-2018:1241 None None None 2018-04-29 19:45 UTC
Red Hat Product Errata RHSA-2018:1243 None None None 2018-04-29 19:48 UTC
Red Hat Product Errata RHSA-2019:0036 None None None 2019-01-08 13:44 UTC

Description Pedro Sampaio 2018-03-29 21:19:33 UTC
A flaw was found in source-to-image as shipped with Openshift Enterprise 3.6. A improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.

Comment 6 Jason Shepherd 2018-04-05 01:18:29 UTC
The source-to-image (S2I/STI) builder in OpenShift 3.4-3.9 contains a vulnerability allowing an attacker to gain root access on
the host system. The underlying cause is comparable to an issue in Kubernetes' kubectl (and "oc") which was reported publicly on the 25th March 2018 [1]. 

[1] https://github.com/kubernetes/kubernetes/issues/61297

OpenShift contains similar code as part of its S2I module, specifically in "openshift/source-to-image/pkg/tar/tar.go:ExtractTarStreamFromTarReader". Paths
from a tar archive are used as input to "filepath.Join" without further sanitation. "ExtractTarStreamFromTarReader" is also used on the client side by "oc rsync". S2I uses the code to unpack artifacts in its main container.

Comment 11 Trevor Jay 2018-04-05 10:55:41 UTC
Some observations:

*Flaw is not in the GO tar implementation but is in the failure to restrict the execution context. The writing is done by a process with inflated privileges. S2I in general has too many privileges for a service that processes Turing complete user input.
* Major area of concern is within S2I, but other affected areas are known to exist.

Comment 13 Jason Shepherd 2018-04-06 00:00:11 UTC
Acknowledgments:

Name: Michael Hanselmann (hansmi.ch)

Comment 31 Kurt Seifried 2018-04-27 18:20:55 UTC
External References:

https://access.redhat.com/security/vulnerabilities/3422241

Comment 33 Kurt Seifried 2018-04-27 20:07:50 UTC
Mitigation:

Customers can turn off the source-to-image (S2I) build strategy to prevent access to the exploitable function.  Information about how to disable the source-to-image build strategy is in the product documentation.

* Disabling S2I in OpenShift Enterprise 3.0 - https://docs.openshift.com/enterprise/3.0/admin_guide/securing_builds.html#disabling-a-build-strategy-globally
* Disabling S2I in OpenShift Enterprise 3.1 - https://docs.openshift.com/enterprise/3.1/admin_guide/securing_builds.html#disabling-a-build-strategy-globally
* Disabling S2I in OpenShift Enterprise 3.2 - https://docs.openshift.com/enterprise/3.2/admin_guide/securing_builds.html#disabling-a-build-strategy-globally
* Disabling S2I in OpenShift Enterprise 3.3 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.3/html/cluster_administration/admin-guide-securing-builds
* Disabling S2I in OpenShift Enterprise 3.4 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.4/html/cluster_administration/admin-guide-securing-builds
* Disabling S2I in OpenShift Enterprise 3.5 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.5/html/cluster_administration/admin-guide-securing-builds
* Disabling S2I in OpenShift Enterprise 3.6 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.6/html/cluster_administration/admin-guide-securing-builds
* Disabling S2I in OpenShift Enterprise 3.7 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.7/html/cluster_administration/admin-guide-securing-builds
* OpenShift Enterprise 3.8 is not a production version (only for upgrades).
* Disabling S2I in OpenShift Enterprise 3.9 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.9/html/cluster_administration/admin-guide-securing-builds

Comment 34 errata-xmlrpc 2018-04-28 03:36:32 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.9

Via RHSA-2018:1227 https://access.redhat.com/errata/RHSA-2018:1227

Comment 35 errata-xmlrpc 2018-04-28 11:56:26 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.8

Via RHSA-2018:1229 https://access.redhat.com/errata/RHSA-2018:1229

Comment 36 errata-xmlrpc 2018-04-29 14:36:35 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.7

Via RHSA-2018:1231 https://access.redhat.com/errata/RHSA-2018:1231

Comment 37 errata-xmlrpc 2018-04-29 19:39:00 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.3

Via RHSA-2018:1239 https://access.redhat.com/errata/RHSA-2018:1239

Comment 38 errata-xmlrpc 2018-04-29 19:44:50 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.2

Via RHSA-2018:1241 https://access.redhat.com/errata/RHSA-2018:1241

Comment 39 errata-xmlrpc 2018-04-29 19:48:41 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Enterprise 3.1

Via RHSA-2018:1243 https://access.redhat.com/errata/RHSA-2018:1243

Comment 40 errata-xmlrpc 2018-04-30 04:00:15 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.6

Via RHSA-2018:1233 https://access.redhat.com/errata/RHSA-2018:1233

Comment 41 errata-xmlrpc 2018-04-30 05:00:57 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.5

Via RHSA-2018:1235 https://access.redhat.com/errata/RHSA-2018:1235

Comment 42 errata-xmlrpc 2018-04-30 05:26:47 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.4

Via RHSA-2018:1237 https://access.redhat.com/errata/RHSA-2018:1237

Comment 44 Jason Shepherd 2018-09-10 05:44:58 UTC
OpenShift Origin commit:

https://github.com/openshift/origin/commit/feca06be8b5a70d10d62a81938808e9afcaed372

Comment 48 Riccardo Schirone 2018-12-13 14:46:55 UTC
Statement:

Package source-to-image as shipped in Red Hat Software Collections has been rated as Important, because it allows an attacker to get access to the victim's machine, but it requires user interaction.

Comment 49 Tomas Hoger 2019-01-07 14:34:54 UTC
source-to-image upstream commit:

https://github.com/openshift/source-to-image/commit/f5cbcbc5cc6f8cc2f479a7302443bea407a700cb

Comment 50 errata-xmlrpc 2019-01-08 13:44:44 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:0036 https://access.redhat.com/errata/RHSA-2019:0036


Note You need to log in before you can comment on or make changes to this bug.