Bug 780582 (CVE-2021-29136)

Summary:	app-containers/umoci: host file overwrite
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	trivial	CC:	williamh
Priority:	Normal	Keywords:	PullRequest
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v
See Also:	https://github.com/gentoo/gentoo/pull/34680
Whiteboard:	~1 [ebuild]
Package list:		Runtime testing required:	---
Bug Depends on:	784116
Bug Blocks:

Description John Helmert III archtester

2021-04-06 13:16:15 UTC

CVE-2021-29136:

umoci 0.4.6 and earlier can be tricked into modifying host files by
creating a malicious layer that has a symlink with the name "." (or
"/"). Because umoci deletes inodes if they change types, this results in
the rootfs directory being replaced with an attacker-controlled symlink.
Subsequent image layers will then be applied on top of the target of the
symlink (which could be any directory on the host filesystem the user
running umoci has access to).

While umoci does have defences against symlink-based attacks, they are
all implemented by resolving things relative to the rootfs directory --
if the rootfs itself is a symlink, umoci resolves it first.

This vulnerability affects both "umoci unpack" and "umoci raw unpack".


Fixed in 0.4.7. Please bump.

Comment 1 Marek Szuba archtester

2021-04-19 11:42:52 UTC

According to upstream, <sys-cluster/singularity-3.7.3 is vulnerable to this as well.

Comment 2 NATTkA bot gentoo-dev

2021-07-29 17:23:16 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 3 NATTkA bot gentoo-dev

2021-07-29 17:31:36 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 4 NATTkA bot gentoo-dev

2021-07-29 17:39:33 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 5 NATTkA bot gentoo-dev

2021-07-29 17:47:43 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 6 NATTkA bot gentoo-dev

2021-07-29 18:03:40 UTC Comment hidden (obsolete)

Package list is empty or all packages have requested keywords.

Comment 7 NATTkA bot gentoo-dev

2021-07-29 18:11:58 UTC

Package list is empty or all packages have requested keywords.