[ad_1]
Particulars have emerged a few now-patched high-severity vulnerability within the Linux kernel that might doubtlessly be abused to flee a container so as to execute arbitrary instructions on the container host.
The shortcoming resides in a Linux kernel characteristic known as management teams, additionally known as cgroups model 1 (v1), which permits processes to be organized into hierarchical teams, successfully making it attainable to restrict and monitor the utilization of sources equivalent to CPU, reminiscence, disk I/O, and community.
Tracked as CVE-2022-0492 (CVSS rating: 7.0), the problem considerations a case of privilege escalation within the cgroups v1 release_agent performance, a script that is executed following the termination of any course of within the cgroup.
“The difficulty stands out as one of many easiest Linux privilege escalations found in current instances: The Linux kernel mistakenly uncovered a privileged operation to unprivileged customers,” Unit 42 researcher Yuval Avrahami stated in a report revealed this week.
The man web page for cgroups explains its perform as follows –
Whether or not or not the release_agent program is invoked when a selected cgroup turns into empty is set by the worth within the notify_on_release file within the corresponding cgroup listing. If this file comprises the worth 0, then the release_agent program just isn’t invoked. If it comprises the worth 1, the release_agent program is invoked. The default worth for this file within the root cgroup is 0.
Particularly, the Palo Alto Networks risk intelligence workforce famous that the bug is a consequence of a lacking verification to test whether or not the method setting the release_agent file had administrative privileges, thereby making it ripe for potential exploitation.
In different phrases, ought to this release_agent file be overwritten by an attacker, the kernel will be pressured into calling an arbitrary binary configured within the launch agent with the very best attainable permissions – a situation that might successfully enable a whole takeover of the machine.
It is, nonetheless, price noting that solely processes with “root” privileges can write to the file, that means that the vulnerability solely permits root processes to escalate privileges.
“At first look, a privilege escalation vulnerability that may solely be exploited by the foundation consumer could appear weird,” Avrahami defined. “Working as root would not essentially imply full management over the machine: There is a grey space between the foundation consumer and full privileges that features capabilities, namespaces and containers. In these situations the place a root course of would not have full management over the machine, CVE-2022-0492 turns into a severe vulnerability.”
Though containers working with AppArmor or SELinux are protected against the flaw, customers are really useful to apply the patches in mild of the truth that it may very well be abused by different malicious host processes to raise privileges.
That is removed from the primary time release_agent has emerged as an assault vector. In July 2017, Google Mission Zero researcher Felix Wilhelm demonstrated a “fast and soiled” proof-of-concept (PoC) exploit leveraging the characteristic to interrupt out of privileged Kubernetes and Docker containers.
Then in November 2021, cloud safety agency Aqua disclosed particulars of a cryptocurrency mining marketing campaign that used the very same container escape approach to drop the XMRig coin miner on contaminated hosts, making it the primary recorded occasion of real-world exploitation.
“CVE-2022-0492 marks one other Linux vulnerability that may be exploited for container escape,” Avrahami concluded. “Fortuitously, environments that observe greatest practices are protected against this vulnerability. Environments with lax safety controls internet hosting untrusted or publicly uncovered containers are, unsurprisingly, at excessive danger.”
[ad_2]
