Docker’s vulnerability allows reading and writing any file on the host

In Docker discovered vulnerability of parallelism uncertainty, or so called “race condition”.

With its help attacker can write and read any file on a host. Issue involves all Docker versions.

Vulnerability is similar to CVE-2018-15664 and allows attacker rewrite resource pathways after permission and before start of program’s work on this resource (TOCTOU error).

Issue affects FollowSymlinkScope function, vulnerable to base TOCTOU attack. This function is used for secure permission for path while all processes processed in a way as if they are going inside Docker container.

Permitted path is not used at once, but after a while. This occurred “window” can use attackers and add symbolic links that will be finally enabled on the host with superuser’s privileges.

As explained by Suse specialist Aleksa Sarai, this can be done with the help of the ‘docker cp’ utility, which allows copying content between the container and the file system.

“If an attacker can add a symlink component to the path *after* the resolution but *before*
it is operated on, then you could end up resolving the symlink path component on the host as root. In the case of ‘docker cp’ this gives you read *and* write access to any path on the host” , — said Aleksa Sarai.

Trying to avoid vulnerability exploitation, Sarai recommended modifing ‘chrootarchive’ in a way that archive operation would be performed in a safe environment, where superuser is ‘rootfs’ container.

Researcher also presented two scripts – one for writing and second for reading. Prior to publication of details Sarai informed Docker developers.

Source: https://seclists.org