oss-sec mailing list archives
Still unfixed? Re: [oss-security] Linux namespaces: It is possible to escape from bind mounts
From: Jann Horn <jann () thejh net>
Date: Thu, 14 May 2015 23:25:25 +0200
On Fri, Apr 03, 2015 at 12:58:02PM +0200, Jann Horn wrote:
See here for the corresponding patches: <http://permalink.gmane.org/gmane.linux.kernel.containers/29173> <http://permalink.gmane.org/gmane.linux.kernel.containers/29177>
Which apparently haven't landed in the kernel? The last commit mentioning bind mounts I could find is 8f502d5b9e336297, which says: The issue of being able to escape a bind mount has not yet been addressed, as the fixes are not yet mature" And the public security issue trackers of Debian, Ubuntu and Redhat also say that the issue hasn't been fixed: https://access.redhat.com/security/cve/CVE-2015-2925 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1441108 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-2925
Containers on Linux normally use bind mounts to restrict how much of the filesystem is visible for processes inside the container. However, if an attacker can gain capabilities within such a container or can create another user and mount namespace within the existing container, he can do something similar to a double-chroot attack to break out of the bind mount and gain access to the full filesystem to which the bind mount refers: Create folders /A, /A/B, /C, /D inside the namespace. Bind-mount the /A inside the namespace to /D. Let a process chdir to /D/B. Move /D/B over into /C. The process which chdir'ed to /D/B is now in /C/B, but at the same time it is in a bind mount with /D as root. It can then traverse upwards, past what looks like / inside the namespace.
This issue now is nearly 5 months old. :/
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Linux namespaces: It is possible to escape from bind mounts Jann Horn (Apr 03)
- Re: Linux namespaces: It is possible to escape from bind mounts cve-assign (Apr 04)
- Re: Linux namespaces: It is possible to escape from bind mounts Andy Lutomirski (Apr 06)
- Re: Linux namespaces: It is possible to escape from bind mounts cve-assign (Apr 06)
- Re: Linux namespaces: It is possible to escape from bind mounts Andy Lutomirski (Apr 06)
- Still unfixed? Re: [oss-security] Linux namespaces: It is possible to escape from bind mounts Jann Horn (May 14)
- Re: Linux namespaces: It is possible to escape from bind mounts Solar Designer (Jun 12)
- Re: Linux namespaces: It is possible to escape from bind mounts cve-assign (Apr 04)