Amazon Linux AMI : docker (ALAS-2015-522)

high Nessus Plugin ID 83280

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation.
(CVE-2015-3627)

Libcontainer version 1.6.0 introduced changes which facilitated a mount namespace breakout upon respawn of a container. This allowed malicious images to write files to the host system and escape containerization. (CVE-2015-3629)

Several paths underneath /proc were writable from containers, allowing global system manipulation and configuration. These paths included /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. By allowing writes to /proc/fs, it has been noted that CIFS volumes could be forced into a protocol downgrade attack by a root user operating inside of a container. Machines having loaded the timer_stats module were vulnerable to having this mechanism enabled and consumed by a container. (CVE-2015-3630)

By allowing volumes to override files of /proc within a mount namespace, a user could specify arbitrary policies for Linux Security Modules, including setting an unconfined policy underneath AppArmor, or a docker_t policy for processes managed by SELinux. In all versions of Docker up until 1.6.1, it is possible for malicious images to configure volume mounts such that files of proc may be overridden.
(CVE-2015-3631)

Solution

Run 'yum update docker' to update your system.

Plugin Details

Severity: High

ID: 83280

File Name: ala_ALAS-2015-522.nasl

Version: 2.3

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 5/8/2015

Updated: 4/18/2018

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:docker, p-cpe:/a:amazon:linux:docker-devel, p-cpe:/a:amazon:linux:docker-pkg-devel, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Patch Publication Date: 5/7/2015

Reference Information

CVE: CVE-2015-3627, CVE-2015-3629, CVE-2015-3630, CVE-2015-3631

ALAS: 2015-522

Detections

Analytics