Bug 1197870 - (CVE-2022-27651) VUL-0: CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty
(CVE-2022-27651)
VUL-0: CVE-2022-27651: buildah: Default inheritable capabilities for linux co...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Containers Team
Security Team bot
https://smash.suse.de/issue/327612/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-03-31 11:53 UTC by Thomas Leroy
Modified: 2022-09-30 16:21 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2022-03-31 11:53:37 UTC
rh#2066840

A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). Normally, when executable programs have specified permitted file capabilities, otherwise unprivileged users and processes can execute those programs and gain the specified file capabilities up to the bounding set. Due to this bug, containers which included executable programs with inheritable file capabilities allowed otherwise unprivileged users and processes to additionally gain these inheritable file capabilities up to the container's bounding set. Containers which use Linux users and groups to perform privilege separation inside the container are most directly impacted.

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.

Patches
This bug has been fixed in Moby (Docker Engine) 20.10.14. Users should update to this version as soon as possible. Running containers should be stopped, deleted, and recreated for the inheritable capabilities to be reset.

This fix changes Moby (Docker Engine) behavior such that containers are started with a more typical Linux environment. Refer to capabilities(7) for a description of how capabilities work. Note that permitted file capabilities continue to allow for privileges to be raised up to the container's bounding set and that processes may add capabilities to their own inheritable set up to the container's bounding set per the rules described in the manual page. In all cases the container's bounding set provides an upper bound on the capabilities that can be assumed and provides for the container security sandbox.

Workarounds
The entrypoint of a container can be modified to use a utility like capsh(1) to drop inheritable capabilities prior to the primary process starting.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2066840
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-27651
Comment 1 Thomas Leroy 2022-03-31 12:06:57 UTC
It seems that it's another CVE for tracking buildah's dependencies affected by CVE-2022-24769 (bnc#1197517).
As far as I can see, the fix for this CVE is just a version bump of containerd and docker [0], that are affected by CVE-2022-24769.

containerd has been fixed in version 1.5.11 and 1.6.2 for CVE-2022-24769. I can see that in our codestreams, we're using containerd v1.4.1 and v1.5.5, therefore we have every codestreams affected:
- SUSE:SLE-15-SP1:Update	
- SUSE:SLE-15-SP3:Update		
- SUSE:SLE-15-SP4:Update
- openSUSE:Factory


[0] https://github.com/containers/buildah/search?q=CVE-2022-24769&type=issues
Comment 4 Swamp Workflow Management 2022-04-27 16:21:38 UTC
SUSE-SU-2022:1437-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1197870
CVE References: CVE-2022-27651
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    buildah-1.25.1-150300.8.6.1
SUSE Linux Enterprise Module for Containers 15-SP3 (src):    buildah-1.25.1-150300.8.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 5 Swamp Workflow Management 2022-08-05 13:16:19 UTC
SUSE-SU-2022:2680-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1197870
CVE References: CVE-2022-27651
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    buildah-1.25.1-150400.3.3.28
SUSE Linux Enterprise Module for Containers 15-SP4 (src):    buildah-1.25.1-150400.3.3.28

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Marcus Meissner 2022-08-05 13:58:37 UTC
buildah on older SPs will not get fixes as the score is below LTSS threshold.
Comment 9 Swamp Workflow Management 2022-09-30 16:21:34 UTC
SUSE-SU-2022:3480-1: An update that solves three vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 1167864,1181961,1183043,1192999,1197870
CVE References: CVE-2020-10696,CVE-2021-20206,CVE-2022-27651
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    buildah-1.25.1-150100.3.13.12
SUSE Manager Retail Branch Server 4.1 (src):    buildah-1.25.1-150100.3.13.12
SUSE Manager Proxy 4.1 (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise Server 15-SP2-BCL (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise Server 15-SP1-BCL (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    buildah-1.25.1-150100.3.13.12
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    buildah-1.25.1-150100.3.13.12
SUSE Enterprise Storage 7 (src):    buildah-1.25.1-150100.3.13.12
SUSE Enterprise Storage 6 (src):    buildah-1.25.1-150100.3.13.12
SUSE CaaS Platform 4.0 (src):    buildah-1.25.1-150100.3.13.12

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.