A flaw was found in source-to-image as shipped with Openshift Enterprise 3.6. A improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.
The source-to-image (S2I/STI) builder in OpenShift 3.4-3.9 contains a vulnerability allowing an attacker to gain root access on the host system. The underlying cause is comparable to an issue in Kubernetes' kubectl (and "oc") which was reported publicly on the 25th March 2018 [1]. [1] https://github.com/kubernetes/kubernetes/issues/61297 OpenShift contains similar code as part of its S2I module, specifically in "openshift/source-to-image/pkg/tar/tar.go:ExtractTarStreamFromTarReader". Paths from a tar archive are used as input to "filepath.Join" without further sanitation. "ExtractTarStreamFromTarReader" is also used on the client side by "oc rsync". S2I uses the code to unpack artifacts in its main container.
Some observations: *Flaw is not in the GO tar implementation but is in the failure to restrict the execution context. The writing is done by a process with inflated privileges. S2I in general has too many privileges for a service that processes Turing complete user input. * Major area of concern is within S2I, but other affected areas are known to exist.
Acknowledgments: Name: Michael Hanselmann (hansmi.ch)
External References: https://access.redhat.com/security/vulnerabilities/3422241
Mitigation: Customers can turn off the source-to-image (S2I) build strategy to prevent access to the exploitable function. Information about how to disable the source-to-image build strategy is in the product documentation. * Disabling S2I in OpenShift Enterprise 3.0 - https://docs.openshift.com/enterprise/3.0/admin_guide/securing_builds.html#disabling-a-build-strategy-globally * Disabling S2I in OpenShift Enterprise 3.1 - https://docs.openshift.com/enterprise/3.1/admin_guide/securing_builds.html#disabling-a-build-strategy-globally * Disabling S2I in OpenShift Enterprise 3.2 - https://docs.openshift.com/enterprise/3.2/admin_guide/securing_builds.html#disabling-a-build-strategy-globally * Disabling S2I in OpenShift Enterprise 3.3 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.3/html/cluster_administration/admin-guide-securing-builds * Disabling S2I in OpenShift Enterprise 3.4 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.4/html/cluster_administration/admin-guide-securing-builds * Disabling S2I in OpenShift Enterprise 3.5 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.5/html/cluster_administration/admin-guide-securing-builds * Disabling S2I in OpenShift Enterprise 3.6 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.6/html/cluster_administration/admin-guide-securing-builds * Disabling S2I in OpenShift Enterprise 3.7 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.7/html/cluster_administration/admin-guide-securing-builds * OpenShift Enterprise 3.8 is not a production version (only for upgrades). * Disabling S2I in OpenShift Enterprise 3.9 - https://access.redhat.com/documentation/en-us/openshift_container_platform/3.9/html/cluster_administration/admin-guide-securing-builds
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.9 Via RHSA-2018:1227 https://access.redhat.com/errata/RHSA-2018:1227
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.8 Via RHSA-2018:1229 https://access.redhat.com/errata/RHSA-2018:1229
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.7 Via RHSA-2018:1231 https://access.redhat.com/errata/RHSA-2018:1231
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.3 Via RHSA-2018:1239 https://access.redhat.com/errata/RHSA-2018:1239
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.2 Via RHSA-2018:1241 https://access.redhat.com/errata/RHSA-2018:1241
This issue has been addressed in the following products: Red Hat OpenShift Enterprise 3.1 Via RHSA-2018:1243 https://access.redhat.com/errata/RHSA-2018:1243
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.6 Via RHSA-2018:1233 https://access.redhat.com/errata/RHSA-2018:1233
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.5 Via RHSA-2018:1235 https://access.redhat.com/errata/RHSA-2018:1235
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.4 Via RHSA-2018:1237 https://access.redhat.com/errata/RHSA-2018:1237
OpenShift Origin commit: https://github.com/openshift/origin/commit/feca06be8b5a70d10d62a81938808e9afcaed372
Statement: Package source-to-image as shipped in Red Hat Software Collections has been rated as Important, because it allows an attacker to get access to the victim's machine, but it requires user interaction.
source-to-image upstream commit: https://github.com/openshift/source-to-image/commit/f5cbcbc5cc6f8cc2f479a7302443bea407a700cb
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:0036 https://access.redhat.com/errata/RHSA-2019:0036