CVE-2019-14271:Proof of Concept for Docker Copy (docker cp) Vulnerability Released
Proof-of-concept (PoC) code for a security flaw in Docker, the popular containerization platform, is now public.
Antecedentes
On November 19, researchers at Unit 42, Palo Alto Networks’ research team, published their analysis of a severe vulnerability in the popular container deployment platform, Docker.
Análisis
CVE-2019-14271 is a critical code injection flaw in the Docker copy (docker cp) command, which is used to copy files between containers. Exploitation of this flaw can lead to full container escape by an attacker. It is important to note that to exploit this vulnerability, an attacker would need to include the exploit code in a malicious Docker container image or compromise a container either via another vulnerability or using previously leaked Docker secrets.
While the vulnerability was patched back in July 2019, researchers from Unit 42 published their analysis of the flaw on November 19. According to these researchers, the vulnerability exists in docker cp because a helper process (docker-tar) improperly loads specific libraries from the container file system rather than from the host file system. Specifically, docker-tar loads the Name Service Switch (NSS) libraries, identified by their filenames beginning with libnss. Targeting docker-tar presents an attacker with the necessary capability to gain full root access on the host file system.
To demonstrate exploitation of CVE-2019-14271, the researchers created their own version of an NSS library (libnss_files.so) and added a function called run_at_link(). The function performs a check to ensure it has been invoked by docker-tar first, followed by a step to replace the malicious libnss_files.so file with the legitimate one, because it is only intended to run once. Finally, the NSS library will request an executable that writes a message to a specified path (/evil) and mounts the host filesystem on the container at the /host_fs path. A video demonstration of this exploit can be found in the Palo Alto Networks blog.
Prueba de concepto
In their blog, Unit 42 researchers included a PoC in the form of a malicious NSS library file, libnss_files.so.
Solución
As mentioned previously, Docker patched this vulnerability back in July in Docker version 19.03.1. Docker users are encouraged to update as soon as possible.
If updating to a patched version is not feasible at this time, users are strongly encouraged to only use trusted Docker container images that have been verified and/or signed. Additionally, please consider using non-root users when launching containers, as that would mitigate the threat this vulnerability poses.
Identificación de los sistemas afectados
A list of Tenable plugins to identify this vulnerability can be found here.
Obtenga más información
- Palo Alto Networks blog on CVE-2019-14271
- Release Notes from Docker for version 19.03.1
- Debian Security Tracker for CVE-2019-14271
- SUSE Advisory for CVE-2019-14271
Únase al Equipo de respuesta de seguridad de Tenable en Tenable Community.
Obtenga más información sobre Tenable, la primera plataforma de Cyber Exposure para el control integral de la superficie de ataque moderna.
Get a free 60-day trial of Tenable.io Vulnerability Management.
Artículos relacionados
Unlocking Kubernetes Innovation Through Simplified Cloud Security with Tenable
March 19, 2024Tenable Cloud Security simplifies Kubernetes security by providing any containerized environment with new features including easy custom policy enforcement, enhanced access control, Helm charts scanning and workload protection. The capabilities offer powerful means for securing your clusters effortlessly, with meaningful, identity-driven insights.
Taking Control of Kubernetes: Enforcing Least Privilege to Secure Your Kubernetes Environment
March 18, 2024Kubernetes has become the de facto standard for managing containerized workloads in private and public clouds. However, security standards have failed to keep pace, leading to increased risk of cyberattacks and data breaches for insecure or misconfigured platforms. Here we examine the challenges involved and explain how to protect your Kubernetes environment by enforcing least privilege across all deployments – whether on-premises or hosted in the public cloud.
Managed Kubernetes: Is It Right for My Organization?
February 20, 2024As an organization grows its usage of containers, managing them becomes more complex. A common response is to adopt Kubernetes for container orchestration. But how do you properly secure your Kubernetes clusters? And should your organization host its Kubernetes deployments or instead choose a managed option? Here’s what you need to know.
Tenable and Thales Collaborate to Provide Cyber Defense Simulations to Better Secure Operational Technology Environments
April 18, 2024The heart of the Welsh Valleys is home to the Thales Ebbw Vale campus, a world-class facility jointly funded by the Welsh government as part of its regeneration program for the region. At the core of the facility is the Cyber Range, a simulation and virtualization platform for training, testing, exercising and R&D. Tenable has joined the lineup of solutions used to run real world simulations in this controlled environment.
Oracle April 2024 Critical Patch Update Addresses 239 CVEs
April 17, 2024Oracle addresses 239 CVEs in its second quarterly update of 2024 with 441 patches, including 38 critical updates.
Strengthening the Nessus Software Supply Chain with SLSA
April 16, 2024You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. But sometimes we like to give you a peek behind the curtain to share how we protect our own house against cyberattacks – and that’s what this blog is about. Today we’re sharing our experience adopting the supply-chain security framework SLSA, with the hopes that the lessons we learned will be helpful to you.
- Container security
- Vulnerability Management