Bug 1915734 (CVE-2021-20188) - CVE-2021-20188 podman: container users permissions are not respected in privileged containers
Summary: CVE-2021-20188 podman: container users permissions are not respected in privi...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-20188
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1917748 1819812 1917747 1917749 1918282 1918283 1918284 1918285 1918286 1920380 1920381 1920382 1920383 1927665 1934649
Blocks: 1909273
TreeView+ depends on / blocked
 
Reported: 2021-01-13 11:21 UTC by Riccardo Schirone
Modified: 2021-04-13 08:30 UTC (History)
29 users (show)

Fixed In Version: podman 1.7.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in podman. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-02-11 16:10:08 UTC
Embargoed:


Attachments (Terms of Use)
Proposed patch for Podman v1.6 (RHEL 2.0 stream) (7.12 KB, patch)
2021-01-21 21:26 UTC, Matthew Heon
no flags Details | Diff
Proposed patch for Podman v1.0 (RHEL 1.0 stream) (10.38 KB, patch)
2021-01-25 19:27 UTC, Matthew Heon
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:0754 0 None None None 2021-03-08 18:22:50 UTC
Red Hat Product Errata RHSA-2021:0681 0 None None None 2021-03-01 14:56:08 UTC
Red Hat Product Errata RHSA-2021:0705 0 None None None 2021-03-02 18:38:41 UTC
Red Hat Product Errata RHSA-2021:0706 0 None None None 2021-03-02 19:08:13 UTC
Red Hat Product Errata RHSA-2021:0710 0 None None None 2021-03-03 10:30:16 UTC

Description Riccardo Schirone 2021-01-13 11:21:54 UTC
Podman versions prior to 1.7.0 ignore file permissions for non-root users running in a privileged container. This flaw allows a low privileged user to access (in read/write mode) any other file in the container, even if owned by the container root user. This means any user inside the privileged container has effectively the same privileges as the root user in the container.

Comment 1 Riccardo Schirone 2021-01-14 09:50:14 UTC
Attack Complexity set to High (AC:H) in CVSSv3 because to use this flaw an attacker already needs access to a privileged container as a low-privileged user. If the container is used to run a service (e.g. a database) the service has first to be compromised.

Once root, an attacker potentially has the same permissions of the user that launched the container, due to the fact that the container has to be privileged.

Comment 3 Riccardo Schirone 2021-01-14 15:28:06 UTC
This flaw seems very similar to CVE-2018-10856, however this requires a privileged container.

Comment 7 Riccardo Schirone 2021-01-20 11:56:26 UTC
This issue was fixed as part of https://github.com/containers/podman/commit/dcf3c742b1ac4d641d66810113f3d17441a412f4, however this commit contains many changes.

Comment 8 Riccardo Schirone 2021-01-20 11:57:39 UTC
The issue could be reproduced in podman versions down to, at least, v1.0.2-dev.

Comment 9 Matthew Heon 2021-01-20 14:20:30 UTC
I suspect we will need different patches for Podman 1.6 and 1.0, given the substantial differences in the codebase between these two releases. I will try and get both patches written after lunch.

Comment 10 Matthew Heon 2021-01-21 21:26:29 UTC
Created attachment 1749548 [details]
Proposed patch for Podman v1.6 (RHEL 2.0 stream)

Initial patch for Podman 1.6 attached. I have not yet verified that it applies cleanly against Podman 1.0; I suspect additional changes will be required.

Comment 11 Matthew Heon 2021-01-22 15:31:52 UTC
Jindrich - can you do a scratch-build of Podman 1.6.4 (2.0 stream from 8.3 should work well) with the patch I provided, for testing?

Comment 13 Matthew Heon 2021-01-25 15:57:12 UTC
Efforts to patch Podman 1.0 are not going well - the code there is sufficiently old that it's using a completely different method for `podman exec` that does not support the fine-tuning of capabilities we can do on newer versions. I will consult with my team, but it may be that the best way forward is to completely disable capability handling when the exec session is not run as root.

Comment 14 Daniel Walsh 2021-01-25 17:14:39 UTC
I agree, noone should be using this, so removing any capability handling seems to be the safest course of action.

Most users are using podman 1.6.* or newer.

Comment 15 Matthew Heon 2021-01-25 17:46:19 UTC
Problem: I cannot, without an extensive rewrite, remove capabilities.

With my current patch, a Podman 1.0 exec session (non-root user in a privileged container) looks like this:

CapInh:	0000003fffffffff
CapPrm:	0000003fffffffff
CapEff:	0000003fffffffff
CapBnd:	0000003fffffffff
CapAmb:	0000003fffffffff

The correct behavior, which exists on master and 1.6 after my above patch:

CapInh:	0000003fffffffff
CapPrm:	0000000000000000
CapEff:	0000000000000000
CapBnd:	0000003fffffffff
CapAmb:	0000000000000000

Given this, it looks like I'm going to need to make some extensive changes to 1.0's exec code, to send the Process block to the OCI runtime so we can tweak capabilities. I am somewhat concerned I'm going to introduce other regressions in the process, but I see no other way forward. This may take most of today and tomorrow to get right.

Comment 16 Matthew Heon 2021-01-25 19:27:38 UTC
Created attachment 1750688 [details]
Proposed patch for Podman v1.0 (RHEL 1.0 stream)

Attached is a proposed patch for Podman 1.0. I have verified that it resolves the CVE, but it involves an uncomfortably large change to exec functionality. I need to do further testing to verify that we did not regress in other ways.

Comment 18 Matthew Heon 2021-01-26 14:19:00 UTC
After further testing, I'm satisfied with the 1.0 patch - it seems to match pre-patch behavior for all significant cases.

Comment 19 Riccardo Schirone 2021-02-02 11:56:57 UTC
Running a `sleep` process in a container with different configurations.

Vulnerable version (without --privileged, user 0 in the container):
CapInh: 00000000a80425fb
CapPrm: 00000000a80425fb
CapEff: 00000000a80425fb
CapBnd: 00000000a80425fb
CapAmb: 00000000a80425fb

Vulnerable version (without --privileged, user X in the container):
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 00000000a80425fb
CapAmb: 0000000000000000

Vulnerable version (with --privileged, user 0 in the container):
CapInh: 0000003fffffffff
CapPrm: 0000003fffffffff
CapEff: 0000003fffffffff
CapBnd: 0000003fffffffff
CapAmb: 0000003fffffffff

Vulnerable version (with --privileged, user X in the container):
CapInh: 0000003fffffffff
CapPrm: 0000003fffffffff
CapEff: 0000003fffffffff
CapBnd: 0000003fffffffff
CapAmb: 0000003fffffffff

When podman is vulnerable to this flaw, running a process with --privileged, even if from a non-root user, keeps all the Capabilities (same as user 0 inside the container), including CAP_DAC_OVERRIDE. By keeping that capability, the processes inside the container running as a non-root user are still able to access files owned by other users, because they actually bypass the discretionary access control.

Comment 21 Riccardo Schirone 2021-02-03 14:47:36 UTC
Statement:

OpenShift Container Platform 3.11 (OCP) has previously packaged podman, but instead now relies on the version from rhel-extras. The older version previously packaged is marked as wontfix.

This issue did not affect the versions of podman provided in the Container Tools module, stream rhel8, as shipped in Red Hat Enterprise Linux 8 as the issue was already fixed in those versions.

Comment 25 Riccardo Schirone 2021-02-11 10:13:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8 / container-tools:rhel8

Via RHSA-2020:3053 https://access.redhat.com/errata/RHSA-2020:3053

Comment 26 Product Security DevOps Team 2021-02-11 16:10:08 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-20188

Comment 27 errata-xmlrpc 2021-03-01 14:56:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extras

Via RHSA-2021:0681 https://access.redhat.com/errata/RHSA-2021:0681

Comment 28 errata-xmlrpc 2021-03-02 18:38:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0705 https://access.redhat.com/errata/RHSA-2021:0705

Comment 29 errata-xmlrpc 2021-03-02 19:08:10 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0706 https://access.redhat.com/errata/RHSA-2021:0706

Comment 30 errata-xmlrpc 2021-03-03 10:30:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:0710 https://access.redhat.com/errata/RHSA-2021:0710


Note You need to log in before you can comment on or make changes to this bug.