* [meta-virtualization][kirkstone][PATCH] lxc: backport patch to fix CVE-2022-47952
@ 2023-01-18 1:29 Xiangyu Chen
2023-01-19 20:14 ` Bruce Ashfield
0 siblings, 1 reply; 2+ messages in thread
From: Xiangyu Chen @ 2023-01-18 1:29 UTC (permalink / raw)
To: meta-virtualization
From: Xiangyu Chen <xiangyu.chen@windriver.com>
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
---
...ching-an-incoming-CVE-CVE-2022-47952.patch | 76 +++++++++++++++++++
recipes-containers/lxc/lxc_git.bb | 1 +
2 files changed, 77 insertions(+)
create mode 100644 recipes-containers/lxc/files/0001-Patching-an-incoming-CVE-CVE-2022-47952.patch
diff --git a/recipes-containers/lxc/files/0001-Patching-an-incoming-CVE-CVE-2022-47952.patch b/recipes-containers/lxc/files/0001-Patching-an-incoming-CVE-CVE-2022-47952.patch
new file mode 100644
index 0000000..d5a02f4
--- /dev/null
+++ b/recipes-containers/lxc/files/0001-Patching-an-incoming-CVE-CVE-2022-47952.patch
@@ -0,0 +1,76 @@
+From 1b0469530d7a38b8f8990e114b52530d1bf7f3b8 Mon Sep 17 00:00:00 2001
+From: Maher Azzouzi <maherazz04@gmail.com>
+Date: Sun, 25 Dec 2022 13:50:25 +0100
+Subject: [PATCH] Patching an incoming CVE (CVE-2022-47952)
+
+lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may
+allow local users to infer whether any file exists, even within a
+protected directory tree, because "Failed to open" often indicates
+that a file does not exist, whereas "does not refer to a network
+namespace path" often indicates that a file exists. NOTE: this is
+different from CVE-2018-6556 because the CVE-2018-6556 fix design was
+based on the premise that "we will report back to the user that the
+open() failed but the user has no way of knowing why it failed";
+however, in many realistic cases, there are no plausible reasons for
+failing except that the file does not exist.
+
+PoC:
+> % ls /l
+> ls: cannot open directory '/l': Permission denied
+> % /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic delete lol lol /l/h/tt h h
+> cmd/lxc_user_nic.c: 1096: main: Failed to open "/l/h/tt" <----- file does not exist.
+> % /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic delete lol lol /l/h/t h h
+> cmd/lxc_user_nic.c: 1101: main: Path "/l/h/t" does not refer to a network namespace path <---- file exist!
+
+Upstream-Status: Backport from https://github.com/lxc/lxc/commit/1b0469530d7a38b8f8990e114b52530d1bf7f3b8
+CVE: CVE-2022-47952
+
+Signed-off-by: MaherAzzouzi <maherazz04@gmail.com>
+Acked-by: Serge Hallyn <serge@hallyn.com>
+Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
+---
+ src/lxc/cmd/lxc_user_nic.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/src/lxc/cmd/lxc_user_nic.c b/src/lxc/cmd/lxc_user_nic.c
+index a91e2259d..69bc6f17d 100644
+--- a/src/lxc/cmd/lxc_user_nic.c
++++ b/src/lxc/cmd/lxc_user_nic.c
+@@ -1085,20 +1085,17 @@ int main(int argc, char *argv[])
+ } else if (request == LXC_USERNIC_DELETE) {
+ char opath[LXC_PROC_PID_FD_LEN];
+
+- /* Open the path with O_PATH which will not trigger an actual
+- * open(). Don't report an errno to the caller to not leak
+- * information whether the path exists or not.
+- * When stracing setuid is stripped so this is not a concern
+- * either.
+- */
++ // Keep in mind CVE-2022-47952: It's crucial not to leak any
++ // information whether open() succeeded of failed.
++
+ netns_fd = open(args.pid, O_PATH | O_CLOEXEC);
+ if (netns_fd < 0) {
+- usernic_error("Failed to open \"%s\"\n", args.pid);
++ usernic_error("Failed while opening netns file for \"%s\"\n", args.pid);
+ _exit(EXIT_FAILURE);
+ }
+
+ if (!fhas_fs_type(netns_fd, NSFS_MAGIC)) {
+- usernic_error("Path \"%s\" does not refer to a network namespace path\n", args.pid);
++ usernic_error("Failed while opening netns file for \"%s\"\n", args.pid);
+ close(netns_fd);
+ _exit(EXIT_FAILURE);
+ }
+@@ -1112,7 +1109,7 @@ int main(int argc, char *argv[])
+ /* Now get an fd that we can use in setns() calls. */
+ ret = open(opath, O_RDONLY | O_CLOEXEC);
+ if (ret < 0) {
+- CMD_SYSERROR("Failed to open \"%s\"\n", args.pid);
++ CMD_SYSERROR("Failed while opening netns file for \"%s\"\n", args.pid);
+ close(netns_fd);
+ _exit(EXIT_FAILURE);
+ }
+--
+2.34.1
+
diff --git a/recipes-containers/lxc/lxc_git.bb b/recipes-containers/lxc/lxc_git.bb
index cecb591..71dce7d 100644
--- a/recipes-containers/lxc/lxc_git.bb
+++ b/recipes-containers/lxc/lxc_git.bb
@@ -48,6 +48,7 @@ SRC_URI = "git://github.com/lxc/lxc.git;branch=stable-4.0;protocol=https \
file://tests-our-init-is-not-busybox.patch \
file://dnsmasq.conf \
file://lxc-net \
+ file://0001-Patching-an-incoming-CVE-CVE-2022-47952.patch \
"
SRCREV = "5ba5725cb4a210c25707beeca64fde5f561d1c71"
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [meta-virtualization][kirkstone][PATCH] lxc: backport patch to fix CVE-2022-47952
2023-01-18 1:29 [meta-virtualization][kirkstone][PATCH] lxc: backport patch to fix CVE-2022-47952 Xiangyu Chen
@ 2023-01-19 20:14 ` Bruce Ashfield
0 siblings, 0 replies; 2+ messages in thread
From: Bruce Ashfield @ 2023-01-19 20:14 UTC (permalink / raw)
To: Xiangyu Chen; +Cc: meta-virtualization
merged.
Bruce
In message: [meta-virtualization][kirkstone][PATCH] lxc: backport patch to fix CVE-2022-47952
on 18/01/2023 Xiangyu Chen wrote:
> From: Xiangyu Chen <xiangyu.chen@windriver.com>
>
> Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
> ---
> ...ching-an-incoming-CVE-CVE-2022-47952.patch | 76 +++++++++++++++++++
> recipes-containers/lxc/lxc_git.bb | 1 +
> 2 files changed, 77 insertions(+)
> create mode 100644 recipes-containers/lxc/files/0001-Patching-an-incoming-CVE-CVE-2022-47952.patch
>
> diff --git a/recipes-containers/lxc/files/0001-Patching-an-incoming-CVE-CVE-2022-47952.patch b/recipes-containers/lxc/files/0001-Patching-an-incoming-CVE-CVE-2022-47952.patch
> new file mode 100644
> index 0000000..d5a02f4
> --- /dev/null
> +++ b/recipes-containers/lxc/files/0001-Patching-an-incoming-CVE-CVE-2022-47952.patch
> @@ -0,0 +1,76 @@
> +From 1b0469530d7a38b8f8990e114b52530d1bf7f3b8 Mon Sep 17 00:00:00 2001
> +From: Maher Azzouzi <maherazz04@gmail.com>
> +Date: Sun, 25 Dec 2022 13:50:25 +0100
> +Subject: [PATCH] Patching an incoming CVE (CVE-2022-47952)
> +
> +lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may
> +allow local users to infer whether any file exists, even within a
> +protected directory tree, because "Failed to open" often indicates
> +that a file does not exist, whereas "does not refer to a network
> +namespace path" often indicates that a file exists. NOTE: this is
> +different from CVE-2018-6556 because the CVE-2018-6556 fix design was
> +based on the premise that "we will report back to the user that the
> +open() failed but the user has no way of knowing why it failed";
> +however, in many realistic cases, there are no plausible reasons for
> +failing except that the file does not exist.
> +
> +PoC:
> +> % ls /l
> +> ls: cannot open directory '/l': Permission denied
> +> % /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic delete lol lol /l/h/tt h h
> +> cmd/lxc_user_nic.c: 1096: main: Failed to open "/l/h/tt" <----- file does not exist.
> +> % /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic delete lol lol /l/h/t h h
> +> cmd/lxc_user_nic.c: 1101: main: Path "/l/h/t" does not refer to a network namespace path <---- file exist!
> +
> +Upstream-Status: Backport from https://github.com/lxc/lxc/commit/1b0469530d7a38b8f8990e114b52530d1bf7f3b8
> +CVE: CVE-2022-47952
> +
> +Signed-off-by: MaherAzzouzi <maherazz04@gmail.com>
> +Acked-by: Serge Hallyn <serge@hallyn.com>
> +Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
> +---
> + src/lxc/cmd/lxc_user_nic.c | 15 ++++++---------
> + 1 file changed, 6 insertions(+), 9 deletions(-)
> +
> +diff --git a/src/lxc/cmd/lxc_user_nic.c b/src/lxc/cmd/lxc_user_nic.c
> +index a91e2259d..69bc6f17d 100644
> +--- a/src/lxc/cmd/lxc_user_nic.c
> ++++ b/src/lxc/cmd/lxc_user_nic.c
> +@@ -1085,20 +1085,17 @@ int main(int argc, char *argv[])
> + } else if (request == LXC_USERNIC_DELETE) {
> + char opath[LXC_PROC_PID_FD_LEN];
> +
> +- /* Open the path with O_PATH which will not trigger an actual
> +- * open(). Don't report an errno to the caller to not leak
> +- * information whether the path exists or not.
> +- * When stracing setuid is stripped so this is not a concern
> +- * either.
> +- */
> ++ // Keep in mind CVE-2022-47952: It's crucial not to leak any
> ++ // information whether open() succeeded of failed.
> ++
> + netns_fd = open(args.pid, O_PATH | O_CLOEXEC);
> + if (netns_fd < 0) {
> +- usernic_error("Failed to open \"%s\"\n", args.pid);
> ++ usernic_error("Failed while opening netns file for \"%s\"\n", args.pid);
> + _exit(EXIT_FAILURE);
> + }
> +
> + if (!fhas_fs_type(netns_fd, NSFS_MAGIC)) {
> +- usernic_error("Path \"%s\" does not refer to a network namespace path\n", args.pid);
> ++ usernic_error("Failed while opening netns file for \"%s\"\n", args.pid);
> + close(netns_fd);
> + _exit(EXIT_FAILURE);
> + }
> +@@ -1112,7 +1109,7 @@ int main(int argc, char *argv[])
> + /* Now get an fd that we can use in setns() calls. */
> + ret = open(opath, O_RDONLY | O_CLOEXEC);
> + if (ret < 0) {
> +- CMD_SYSERROR("Failed to open \"%s\"\n", args.pid);
> ++ CMD_SYSERROR("Failed while opening netns file for \"%s\"\n", args.pid);
> + close(netns_fd);
> + _exit(EXIT_FAILURE);
> + }
> +--
> +2.34.1
> +
> diff --git a/recipes-containers/lxc/lxc_git.bb b/recipes-containers/lxc/lxc_git.bb
> index cecb591..71dce7d 100644
> --- a/recipes-containers/lxc/lxc_git.bb
> +++ b/recipes-containers/lxc/lxc_git.bb
> @@ -48,6 +48,7 @@ SRC_URI = "git://github.com/lxc/lxc.git;branch=stable-4.0;protocol=https \
> file://tests-our-init-is-not-busybox.patch \
> file://dnsmasq.conf \
> file://lxc-net \
> + file://0001-Patching-an-incoming-CVE-CVE-2022-47952.patch \
> "
>
> SRCREV = "5ba5725cb4a210c25707beeca64fde5f561d1c71"
> --
> 2.34.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#7815): https://lists.yoctoproject.org/g/meta-virtualization/message/7815
> Mute This Topic: https://lists.yoctoproject.org/mt/96345539/1050810
> Group Owner: meta-virtualization+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-01-19 20:14 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-18 1:29 [meta-virtualization][kirkstone][PATCH] lxc: backport patch to fix CVE-2022-47952 Xiangyu Chen
2023-01-19 20:14 ` Bruce Ashfield
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.