Bug in the Linux Kernel Allows Privilege Escalation, Container Escape

To go along with the “Dirty Pipe” Linux security bug coming to mild, two scientists from Huawei – Yiqi Solar and Kevin Wang – have found a vulnerability in the “control groups” function of the Linux kernel which enables attackers to escape containers, escalate privileges and execute arbitrary commands on a host device.

The bug (CVE-2022-0492) exists in the Linux kernel’s “cgroup_release_agent_write” characteristic, which is identified in the “kernel/cgroup/cgroup-v1.c” function.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“This flaw, below selected situation, makes it possible for the use of the cgroups v1 release_agent aspect to escalate privileges and bypass the namespace isolation unexpectedly,” in accordance to a NIST Countrywide Vulnerability Database advisory, which has not nevertheless claimed a CVSS severity score for the bug. This permits container escape in Kubernetes environments, the researchers observed – i.e., the capacity to obtain other users’ containers in community cloud environments.

“Although containers offer a higher diploma of security,” Delinea senior solution promoting manager,Shweta Khare, wrote by means of email, “recent incidents have demonstrated that containers are getting exploited often via these kinds of vulnerabilities.”

Unprivileged Consumers Can Carry out Privileged Functions

Linux regulate teams – “cgroups” – permit system admins to allocate computing assets – memory, bandwidth, etc. – amid no matter what processes could operate on a system. In the phrases of Pink Hat – a main contributor to the Linux kernel – cgroups let for “fine-grained manage in excess of allocating, prioritizing, denying, controlling and checking technique methods.” In the correct fingers cgroups are, for that reason, a highly effective instrument for manage and security in excess of a program.

There are two varieties of cgroups architecture – termed v1 and v2 – and CVE-2022-0492 has an effect on only v1, it ought to be observed.

According to Palo Alto Networks researchers, who wrote their have assessment and patch for the issue, “Linux simply just didn’t verify that the method placing the release_agent file has administrative privileges (i.e. the CAP_SYS_ADMIN functionality).”

The launch_agent file “allows administrators to configure a ‘release agent’ software that would run on the termination of a procedure in the cgroup,” They added. So, attackers able of writing to the release_agent file can exploit it to attain complete admin privileges.

On Feb. 4, a security researcher described that the bug experienced been set by demanding “capabilities to set release_agent.”

In accordance to the Github dedicate, “the cgroup release_agent is named with ‘call_usermodehelper.’ The perform phone_usermodehelper starts off the release_agent with a comprehensive set of abilities. As a result, have to have capabilities when location the release_agent.”

A flaw in cgroups may possibly warrant specific focus since, Khare noted, “in most corporations, microservices and containers are not still protected underneath the business security plan.”

She extra, “Enabling granular privilege administration at the container system and the container functioning technique levels throughout the advancement environments,” can aid mitigate these kinds of vulnerabilities, even just before they grow to be extensively identified. Ultimately, while, patching is the most important factor.

The Most recent in a Series of Kernel Bugs

Due to the fact the kernel sits at the core of a computer’s functioning technique, security vulnerabilities that may well come up from it are inclined to be fairly critical. Late very last yr, for illustration, a critical-heap overflow bug launched the risk for distant code execution and whole takeover of Linux machines. That one was rated critical by NIST NVD, with a CVSS score of 9.8 out of 10.

A range of other vulnerabilities have been discovered in the kernel in only the last few months. February brought CVE-2022-0185, a “heap-based mostly overflow flaw” with “the way the legacy_parse_param function in the Filesystem Context features of the Linux kernel confirmed the provided parameters length.” Like CVE-2022-0492, the flaw uncovered the possibility of unauthorized privilege escalation.

Extra just lately – just this Monday, in reality – a researcher released the specifics of CVE-2022-0847 (a.k.a. “Dirty Pipe”), which makes it possible for unprivileged procedures to inject code into root processes, hence overwriting info in arbitrary read through-only files and paving the way for privilege escalation and arbitrary code execution.

“Given the prevalence of Linux in very delicate infrastructure, this is a really critical vulnerability to mitigate,” wrote Paul Zimski, vice president of item system at Automox, by means of email.”. “It is highly suggested that IT and SecOps admins prioritize patching and remediation of this vulnerability in the next 24 hrs to cut down organizational risk.”

Transferring to the cloud? Find rising cloud-security threats together with sound suggestions for how to protect your property with our Totally free downloadable Book, “Cloud Security: The Forecast for 2022.” We explore organizations’ top dangers and troubles, greatest methods for defense, and suggestions for security accomplishment in this sort of a dynamic computing environment, which include useful checklists.