CVE-2018-1069
説明
GlusterFS and NFS network filesystems rely on File System User ID and Group ID information in order to restrict access to file shares. However, it's possible to overwrite the Openshift restrictions on container UserId and GroupdId as they are not validated before being sent over the Openshift Network. An attacker could use the flaw to read and write any data on the network filesystem.
軽減策
If exposing shares with NFS or GlusterFS to Openshift Nodes use EgressNetworkPolicy, [1] to redirect outbound storage network traffic via an egress router. Alternatively if you're on AWS, EgressNetworkPolicy is not supported, you can use a Static IP, [2], for projects to force projects which need storage to connect from a NIC with a unique IP Address.
Once traffic is coming from a known IP address, not the Node IP, you can protect the NFS, or GlusterFS storage node with a firewall, or exports which only allows access from the Egress router, or from the Static IP.
An egress policy such as the one in the redirect-mode, [3], is an example of egress policy which would mitigate this vulnerability. An administrator would need to deploy one of these to the project using storage, as they need to run in privileged mode. This forces all traffic to the storage device through the egress router, which is a distinct IP. You can then configure the storage device to only access traffic from that source IP.
Be aware that during a docker build, the build container is not subject to EgressNetworkPolicy rules in versions prior to 3.7. Also the Static IP feature is only available as a Tech Preview from version 3.7.
An alternative mitigation if you're using Red Hat Gluster Storage is outlined here: https://github.com/gluster/gluster-kubernetes/blob/master/docs/design/tls-security.md
A semi-automatic namespace wide egress-IP is due to be released in OCP 3.11 which will make management of the EgressNetworkPolicy easier. It will only work for the multitenant and networkpolicy plugins.
CVSS (Common Vulnerability Scoring System) のスコアの詳細
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
以下の CSVV メトリクスおよびスコアは予備的で、再検討の対象となります。
CVSS v3 スコアの内訳
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| ベーススコア | 7.1 | 7.1 | N/A |
| 攻撃ベクトル | Adjacent Network | Adjacent Network | N/A |
| 攻撃の複雑さ | High | High | N/A |
| 必要な権限 | Low | Low | N/A |
| ユーザー関与レベル | None | None | N/A |
| 範囲 | Unchanged | Unchanged | N/A |
| 機密性 | High | High | N/A |
| 完全性への影響 | High | High | N/A |
| 可用性への影響 | High | High | N/A |
ベクトル
Red Hat: CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
脆弱性の原因 (CWE) の理解
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
An attacker could provide unexpected values and cause a program crash or arbitrary control of resource allocation, leading to excessive consumption of resources such as memory and CPU.
Confidentiality
Technical Impact: Read Memory; Read Files or Directories
An attacker could read confidential data if they are able to control resource references.
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
An attacker could use malicious input to modify data or possibly alter control flow in unexpected ways, including arbitrary command execution.
謝辞
Red Hat would like to thank Andreas Skoglund (Basefarm AS) for reporting this issue.
よくある質問
Not sure what something means? Check out our Security Glossary.
エラータ通知の受信を希望しますか? こちらで登録してください。
