Alert.png The wiki is deprecated and due to be decommissioned by the end of September 2022.
The content is being migrated to other supports, new updates will be ignored and lost.
If needed you can get in touch with EGI SDIS team using operations @ egi.eu.

Difference between revisions of "SVG:Advisory-SVG-2017-12381"

From EGIWiki
Jump to navigation Jump to search
Line 2: Line 2:


<pre>
<pre>
Title:      [HEADS-UP] Linux kernel root escalation vulnerability [EGI-SVG-2017-6074] 


Title:       EGI SVG Advisory [TLP:WHITE] Up to 'High' risk - Singularity container escape vulnerability [EGI-SVG-2017-12381] 
Date:       2017-02-23


Date:        2017-02-17
TLP and URL
Updated:
===========


WHITE information - Unlimited distribution
see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions
URL:  https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2017-6074
Minor updates may be made without re-distribution to the sites


Affected software and risk
Affected software and risk
==========================
==========================


Up to HIGH risk vulnerability concerning Singularity container escape.
Root escalation vulnerability affecting the Linux kernel
 
Package : kernel
CVE ID  : CVE-2017-6074


Package : Singularity
A double-free vulnerability has been found in the linux kernel module 'dccp',
CVE ID  : N/A
which might allow unprivileged local users to escalate their privileges.
Bug ID  : N/A
This vulnerability is present in all recent versions of the linux kernel.


If unprivileged users are allowed to launch their own containers through Singularity,
The most affected services are those that give shell access to unprivileged users:
it would be possible for a malicious user to create and manipulate specifically crafted
raw devices within containers they own, and then gain access outside their own container.     


- Worker Nodes
- shared User Interface hosts
- ...


Actions required/recommended
Actions required/recommended
============================
============================


Sites running Singularity must update as soon as possible.
The publishing of an exploit is expected to make this a CRITICAL vulnerability.


Sites are therefore advised to deploy the proposed mitigation now and to
plan for a kernel update campaign (including reboot) within the time lines
stated in:


Affected software details
    https://wiki.egi.eu/wiki/SEC03_EGI-CSIRT_Critical_Vulnerability_Handling
=========================


This is fixed in Singularity Version 2.2.1
Mitigation
==========


Earlier versions are vulnerable.  
This vulnerability can be mitigated by disabling DCCP completely. On standard
distributions, where it's present as a kernel module, this can be achieved by
either:
- Adding a modprobe configuration file to disable dccp by running:
```
echo "install dccp /bin/true" >> /etc/modprobe.d/CVE-2017-6074.conf
```
- Removing all DCCP kernel modules from /lib/modules


If the DCCP kernel module is already loaded (lsmod | grep dccp), a reboot
might be needed to unload the module (rmmod will fail if still in use). Please
note however that most systems don't load this module and a loaded module
should be investigated as it could be from an exploitation attempt.


More information
For other systems, where DCCP is statically compiled in the kernel (use grep
================
CONFIG_IP_DCCP /boot/config-$(uname -r) or zgrep CONFIG_IP_DCCP
/proc/config.gz), these mitigations cannot be applied and a new kernel has to
be built and deployed.


See [R 1]
Credit
 
======
We rate this as 'up to High risk' as the actual risk depends on the type of use and local site configuration. 
 
When singularity containers are run via batch systems, which we think is likely to be a typical implementation in EGI,
the vulnerability cannot be exploited.
 
The configurations that allow individual users to upload and execute singularity containers are vulnerable
and must be updated urgently.
 
 
Component installation information
==================================
 
Fixed version is available from [R 1]
 
TLP and URL
===========
 
** WHITE information - Unlimited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions**   
           
URL:  https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2017-12381 
 
Minor updates may be made without re-distribution to the sites
 
 
Comments
========
 
Comments or questions should be sent to svg-rat  at  mailman.egi.eu
 
If you find or become aware of a vulnerability which is relevant to EGI you may report it by e-mail to 
 
report-vulnerability at egi.eu
the EGI Software Vulnerability Group will take a look according to the procedure defined in [R 2] 


This vulnerability was reported to EGI SVG by Tobias Dussa.


References
References
==========
==========


[R 1] https://github.com/singularityware/singularity/releases/tag/2.2.1
[1] http://seclists.org/oss-sec/2017/q1/471


[R 2] https://documents.egi.eu/public/ShowDocument?docid=2538
[2] https://access.redhat.com/security/cve/CVE-2017-6074


Credit
[3] https://access.redhat.com/errata/RHSA-2017:0293
======


This vulnerability was discovered by Mattias Wadenstein
[4] https://access.redhat.com/errata/RHSA-2017:0294


And
[5] https://security-tracker.debian.org/tracker/CVE-2017-6074


SVG was alerted to this vulnerability by Jeny Teheran from Fermilab.
[6] https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-6074.html
 
Testing also carried out by Barbara Krasovec


Timeline   
Timeline   
========
========
Yyyy-mm-dd  [EGI-SVG-2017-12381]
2017-02-03 SVG alerted to this issue by Jeny Teheran.
2017-02-06 Acknowledgement from the EGI SVG to the reporter
2017-02-06 Investigation of vulnerability and relevance to EGI carried out,
          including testing by Barbara Krasovec
2017-02-15 Singularity 2.2.1 security release
2017-02-15 EGI SVG meeting, agreed on 'Up to High' and advisory/alert necessary 
2017-02-17 Advisory/Alert sent to sites
Context
=======
This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose
"To minimize the risk to the EGI infrastructure arising from software vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R 2] 
in the context of how the software is used in the EGI infrastructure. It is the opinion of the group,
we do not guarantee it to be correct. The risk may also be higher or lower in other deployments depending
on how the software is used. 
Others may re-use this information provided they:-
1) Respect the provided TLP classification
2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group


Yyyy-mm-dd  [EGI-SVG-2016-11476]


2017-02-22 Public disclosure, EGI SVG notified by Tobias Dussa
2017-02-23 Heads-up sent to sites
</pre>
</pre>

Revision as of 14:21, 23 February 2017

Main page Software Security Checklist Issue Handling Advisories Notes On Risk Advisory Template More

Advisory-SVG-2017-12381


Title:       [HEADS-UP] Linux kernel root escalation vulnerability [EGI-SVG-2017-6074]  

Date:        2017-02-23

TLP and URL
===========

WHITE information - Unlimited distribution
see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions

URL:   https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2017-6074

Minor updates may be made without re-distribution to the sites

Affected software and risk
==========================

Root escalation vulnerability affecting the Linux kernel

Package : kernel
CVE ID  : CVE-2017-6074

A double-free vulnerability has been found in the linux kernel module 'dccp',
which might allow unprivileged local users to escalate their privileges.
This vulnerability is present in all recent versions of the linux kernel.

The most affected services are those that give shell access to unprivileged users:

- Worker Nodes
- shared User Interface hosts
- ...

Actions required/recommended
============================

The publishing of an exploit is expected to make this a CRITICAL vulnerability.

Sites are therefore advised to deploy the proposed mitigation now and to
plan for a kernel update campaign (including reboot) within the time lines
stated in:

    https://wiki.egi.eu/wiki/SEC03_EGI-CSIRT_Critical_Vulnerability_Handling

Mitigation
==========

This vulnerability can be mitigated by disabling DCCP completely. On standard
distributions, where it's present as a kernel module, this can be achieved by
either:
- Adding a modprobe configuration file to disable dccp by running:
```
echo "install dccp /bin/true" >> /etc/modprobe.d/CVE-2017-6074.conf
```
- Removing all DCCP kernel modules from /lib/modules

If the DCCP kernel module is already loaded (lsmod | grep dccp), a reboot
might be needed to unload the module (rmmod will fail if still in use). Please
note however that most systems don't load this module and a loaded module
should be investigated as it could be from an exploitation attempt.

For other systems, where DCCP is statically compiled in the kernel (use grep
CONFIG_IP_DCCP /boot/config-$(uname -r) or zgrep CONFIG_IP_DCCP
/proc/config.gz), these mitigations cannot be applied and a new kernel has to
be built and deployed.

Credit
======

This vulnerability was reported to EGI SVG by Tobias Dussa.

References
==========

[1] http://seclists.org/oss-sec/2017/q1/471

[2] https://access.redhat.com/security/cve/CVE-2017-6074

[3] https://access.redhat.com/errata/RHSA-2017:0293

[4] https://access.redhat.com/errata/RHSA-2017:0294

[5] https://security-tracker.debian.org/tracker/CVE-2017-6074

[6] https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-6074.html

Timeline  
========

Yyyy-mm-dd  [EGI-SVG-2016-11476] 

2017-02-22 Public disclosure, EGI SVG notified by Tobias Dussa
2017-02-23 Heads-up sent to sites
Retrieved from "https://wiki.egi.eu/w/index.php?title=SVG:Advisory-SVG-2017-12381&oldid=93284"