39 lines
1.6 KiB
Markdown
39 lines
1.6 KiB
Markdown
# CVE-2023-28642: runc AppArmor/SELinux confinement bypass via a symlinked or non-directory /proc inside the container
|
|
|
|
**Scope:** [audit](../README.md) · [README](../../README.md) · [COMPARISON](../../COMPARISON.md) · [docs/RESEARCH](../../docs/RESEARCH.md)
|
|
|
|
Fixed in runc 1.1.5 (USN-6088-1), same release as CVE-2023-27561.
|
|
|
|
## Source
|
|
|
|
- [Ubuntu Security Notice USN-6088-1](https://usn.ubuntu.com/6088-1)
|
|
- [LWN coverage](https://lwn.net/Articles/932370/)
|
|
|
|
## Relevance to doos
|
|
|
|
runc let `/proc` inside the container be a symlink, or let something be mounted over a
|
|
non-directory in its place, which bypassed its AppArmor and (on the right distro)
|
|
SELinux restrictions tied to the real `/proc`. doos has no comparable confinement layered
|
|
on top of `/proc` to bypass (same caveat as `CVE-2019-16884`: no per-container AppArmor
|
|
profile), but the underlying property, that `/proc` is a genuine, fresh directory mount
|
|
and not a symlink an image could have planted, is exactly the same `/proc` doos sets up
|
|
in `src/sandbox.cpp` and worth checking directly rather than only by analogy.
|
|
|
|
|
|
## What the check does
|
|
|
|
From inside a container, confirms `/proc` is a directory and not a symlink
|
|
(`[ -L /proc ]` must be false), on top of the mount-type check `CVE-2019-16884` already
|
|
runs.
|
|
|
|
|
|
## Caveats
|
|
|
|
Checks the filesystem property the runc bug abused (a symlinked `/proc`), not the
|
|
AppArmor/SELinux bypass itself, since doos's hardening model (seccomp + capability drop,
|
|
not AppArmor confinement of the container's own filesystem) is a different mechanism;
|
|
see COMPARISON.md section 6 for that design difference.
|
|
|
|
|
|
Run: `make test` in this directory, or `make -C audit test` from the repo root.
|