oss-security - CVE-2020-16120 - incorrect unprivileged overlayfs permission checking

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue, 13 Oct 2020 10:10:34 -0700
From: Steve Beattie <steve.beattie@...onical.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2020-16120 - incorrect unprivileged overlayfs permission checking

Hello,

CVE-2020-16120 - incorrect unprivileged overlayfs permission checking

Giuseppe Scrivano discovered that overlayfs did not properly perform
permission checking when copying up files in an overlayfs, and can be
exploited from within a user namespace, if, for example, unprivileged
user namespaces are allowed.

An attacker can abuse this to get read access to files on the system
that they would not normally be permitted to access.

This likely only has an impact on Ubuntu kernels, where unprivileged
user namespaces are enabled by default.

The following upstream commits address the issue:

  48bd024b8a40d73ad6b086de2615738da0c7004f ("ovl: switch to mounter creds in readdir")
  56230d956739b9cb1cbde439d76227d77979a04d ("ovl: verify permissions in ovl_path_open()")
  05acefb4872dae89e772729efb194af754c877e8 ("ovl: check permission to open real file")

The following commits also may be desired or necessary:

  130fdbc3d1f9966dd4230709c30f3768bccd3065 ("ovl: pass correct flags for opening real directory")
  292f902a40c11f043a5ca1305a114da0e523eaa3 ("ovl: call secutiry hook in ovl_real_ioctl()")

Mitigation on systems where unprivileged user namespaces are enabled
but not needed is to set the kernel.unprivileged_userns_clone sysctl
to 0. e.g.:

  $ sudo sysctl kernel.unprivileged_userns_clone=0

and across reboots by adding a file in /etc/sysctl.d/ that contains:

  kernel.unprivileged_userns_clone=0

Thanks.

-- 
Steve Beattie
<sbeattie@...ntu.com>

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.