Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 3 Apr 2015 12:58:02 +0200
From: Jann Horn <jann@...jh.net>
To: oss-security@...ts.openwall.com
Subject: Linux namespaces: It is possible to escape from bind mounts

See here for the corresponding patches:
<http://permalink.gmane.org/gmane.linux.kernel.containers/29173>
<http://permalink.gmane.org/gmane.linux.kernel.containers/29177>

Given that it went over a public mailinglist now, I guess there's
not much sense in keeping it secret anymore.

Containers on Linux normally use bind mounts to restrict how much
of the filesystem is visible for processes inside the container.
However, if an attacker can gain capabilities within such a
container or can create another user and mount namespace within
the existing container, he can do something similar to a
double-chroot attack to break out of the bind mount and gain
access to the full filesystem to which the bind mount refers:

Create folders /A, /A/B, /C, /D inside the namespace.
Bind-mount the /A inside the namespace to /D.
Let a process chdir to /D/B.
Move /D/B over into /C.
The process which chdir'ed to /D/B is now in /C/B, but at the
same time it is in a bind mount with /D as root. It can then
traverse upwards, past what looks like / inside the namespace.

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.