New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492) #1969

darryk10 · 2022-04-13T10:11:35Z

This PR add a new rule to detect container escapes techniques (also used CVE-2022-0492 Linux Cgroup Container Escape Vulnerability) using new field available thread.cap_effective to check capabilities in the container which is part of the requirement for the exploitation.
Reference:
https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/
https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/

Signed-off-by: darryk10 [email protected]
Co-authored-by: Lorenzo Susini [email protected]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

If contributing rules or changes to rules, please make sure to also uncomment one of the following line:

/kind rule-update

/kind rule-create

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area rules

/area tests

/area proposals

What this PR does / why we need it:
This PR add a new rule to detect container escapes techniques (also used CVE-2022-0492 Linux Cgroup Container Escape Vulnerability)
Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

rule(Detect release_agent File Container Escapes): new rule created to detect an attempt to exploit a container escape using release_agent file

Kaizhe · 2022-04-15T07:53:49Z

rules/falco_rules.yaml

+- rule: Linux Cgroup Container Escape Vulnerability (CVE-2022-0492)
+  desc: "Detect an attempt to exploit a container escape vulnerability in the Linux Kernel (CVE-2022-0492). By running a container with certains capabilities, a privileged user can modify release_agent file and escape from the container"
+  condition:
+    open_write and fd.name endswith release_agent and (user.uid=0 or thread.cap_permitted contains CAP_DAC_OVERRIDE) and excessively_capable_container


is this excessively_capable_container macro defined somewhere?

the macro is introduced in this PR https://github.com/falcosecurity/falco/pull/1963/files done by @loresuso

Then what non-default capabilities are needed for the exploit?

Kaizhe · 2022-04-15T07:58:00Z

The prerequisite make it hard to exploit:
Quoted from the Unit42 blog:
As the root user, or without the no_new_privs flag; and
Without AppArmor or SELinux; and
Without Seccomp; and
On a host that enables unprivileged user namespaces; and
In a root v1 cgroup.

darryk10 · 2022-04-15T08:36:07Z

Thanks @Kaizhe for the review :)
I think it's worth noting this CVE (along with others) can be exploited in privileged container as well which increase the chance to get exploited.
In addition there are different container escaping techniques that use relase_agent file to reach container escaping. Some of those also found in malwares reported in the following link. The rule created checking the capabilities will trigger on those use cases as well.
https://blog.aquasec.com/threat-alert-container-escape

jasondellaluce · 2022-04-15T08:56:35Z

/milestone 0.32.0

darryk10 · 2022-04-15T10:14:39Z

@Kaizhe Looking at other techniques where release_agent file is involved. I figured out the same rule is effective for all the techniques which involve release_agent file (included the CVE-2022-0492). So I redesigned the rule to be generic on the release_agent file. Hope it's better now :)
References:
https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
https://unit42.paloaltonetworks.com/cve-2022-0492-cgroups/

Thanks again

poiana · 2022-04-29T05:37:36Z

LGTM label has been added.

Git tree hash: 0df959df0be336a07ffa70df7fd2b2e76a94f3a8

leogr · 2022-05-04T11:01:31Z

Closing and reopening to trigger the CI
/close

poiana · 2022-05-04T11:01:34Z

@leogr: Closed this PR.

In response to this:

Closing and reopening to trigger the CI
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

leogr · 2022-05-04T11:01:42Z

/reopen

poiana · 2022-05-04T11:01:44Z

@leogr: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

leogr

I think that tests are failing because the driver version used by this PR is still caa0e4d0044fdaaebab086592a97f0c7f32aeaa9. IIRC, thread.cap_effective was introduced later.

If so, rebasing this PR on top of the current master branch should solve the issue.
@darryk10 could you rebase this PR, please?

Signed-off-by: darryk10 <[email protected]> Co-authored-by: Lorenzo Susini <[email protected]>

leogr

Great, after the rebase, it works 👍

/approve

poiana · 2022-05-12T12:20:04Z

LGTM label has been added.

Git tree hash: 3fec78695d250747677d1877c4d6fd4af9ece392

jasondellaluce

/approve

poiana · 2022-05-12T12:42:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: darryk10, jasondellaluce, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~rules/OWNERS~~ [jasondellaluce,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

poiana added do-not-merge/work-in-progress kind/rule-create release-note area/rules dco-signoff: yes labels Apr 13, 2022

poiana requested review from Kaizhe and leodido April 13, 2022 10:11

poiana added the size/S label Apr 13, 2022

darryk10 changed the title ~~wip: New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-4092)~~ wip: New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492) Apr 13, 2022

Kaizhe reviewed Apr 15, 2022

View reviewed changes

poiana added this to the 0.32.0 milestone Apr 15, 2022

Kaizhe previously approved these changes Apr 29, 2022

View reviewed changes

poiana assigned Kaizhe Apr 29, 2022

poiana added the lgtm label Apr 29, 2022

leogr changed the title ~~wip: New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492)~~ New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492) May 4, 2022

poiana removed the do-not-merge/work-in-progress label May 4, 2022

poiana closed this May 4, 2022

poiana reopened this May 4, 2022

FedeDP mentioned this pull request May 9, 2022

Cut 0.32.0 Release #1993

Closed

53 tasks

leogr reviewed May 12, 2022

View reviewed changes

Added new rule for CVE-2022-4092

c6a0022

Signed-off-by: darryk10 <[email protected]> Co-authored-by: Lorenzo Susini <[email protected]>

darryk10 added 3 commits May 12, 2022 11:42

Fixed CVE number

bca7b1d

Signed-off-by: darryk10 <[email protected]> Co-authored-by: Lorenzo Susini <[email protected]>

Changed Rule focus to be broader then just a specific CVE

6db5510

Signed-off-by: darryk10 <[email protected]> Co-authored-by: Lorenzo Susini <[email protected]>

Changed field in thread.cap_effective

91ac709

Signed-off-by: darryk10 <[email protected]> Co-authored-by: Lorenzo Susini <[email protected]>

darryk10 dismissed Kaizhe’s stale review via 91ac709 May 12, 2022 09:42

darryk10 force-pushed the new_rule_cve_2022_4092 branch from bda5e90 to 91ac709 Compare May 12, 2022 09:42

poiana removed the lgtm label May 12, 2022

leogr approved these changes May 12, 2022

View reviewed changes

poiana assigned leogr May 12, 2022

poiana added the lgtm label May 12, 2022

poiana added the approved label May 12, 2022

jasondellaluce approved these changes May 12, 2022

View reviewed changes

poiana assigned jasondellaluce May 12, 2022

poiana merged commit 3e60318 into falcosecurity:master May 12, 2022

darryk10 deleted the new_rule_cve_2022_4092 branch May 12, 2022 12:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492) #1969

New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492) #1969

darryk10 commented Apr 13, 2022 •

edited

Loading

Kaizhe Apr 15, 2022

darryk10 Apr 15, 2022

Kaizhe Apr 15, 2022

Kaizhe commented Apr 15, 2022 •

edited

Loading

darryk10 commented Apr 15, 2022

jasondellaluce commented Apr 15, 2022

darryk10 commented Apr 15, 2022

poiana commented Apr 29, 2022

leogr commented May 4, 2022

poiana commented May 4, 2022

leogr commented May 4, 2022

poiana commented May 4, 2022

leogr left a comment

leogr left a comment

poiana commented May 12, 2022

jasondellaluce left a comment

poiana commented May 12, 2022

New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492) #1969

New Rule Detect Linux Cgroup Container Escape Vulnerability (CVE-2022-0492) #1969

Conversation

darryk10 commented Apr 13, 2022 • edited Loading

Kaizhe Apr 15, 2022

Choose a reason for hiding this comment

darryk10 Apr 15, 2022

Choose a reason for hiding this comment

Kaizhe Apr 15, 2022

Choose a reason for hiding this comment

Kaizhe commented Apr 15, 2022 • edited Loading

darryk10 commented Apr 15, 2022

jasondellaluce commented Apr 15, 2022

darryk10 commented Apr 15, 2022

poiana commented Apr 29, 2022

leogr commented May 4, 2022

poiana commented May 4, 2022

leogr commented May 4, 2022

poiana commented May 4, 2022

leogr left a comment

Choose a reason for hiding this comment

leogr left a comment

Choose a reason for hiding this comment

poiana commented May 12, 2022

jasondellaluce left a comment

Choose a reason for hiding this comment

poiana commented May 12, 2022

darryk10 commented Apr 13, 2022 •

edited

Loading

Kaizhe commented Apr 15, 2022 •

edited

Loading