mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-10 21:53:57 +08:00
Aleksa Sarai
531ef794e4
When opening the peer end of a pty, the old kernel API required us to
open /dev/pts/$num inside the container (at least since we fixed console
handling many years ago in commit 244c9fc426 ("*: console rewrite")).
The problem is that in a hostile container it is possible for
/dev/pts/$num to be an attacker-controlled symlink that runc can be
tricked into resolving when doing bind-mounts. This allows the attacker
to (among other things) persist /proc/... entries that are later masked
by runc, allowing an attacker to escape through the kernel.core_pattern
sysctl (/proc/sys/kernel/core_pattern). This is the original issue
reported by Lei Wang and Li Fu Bang in CVE-2025-52565.
However, it should be noted that this is not entirely a newly-discovered
problem. Way back in Linux 4.13 (2017), I added the TIOCGPTPEER ioctl,
which allows us to get a pty peer without touching the /dev/pts inside
the container. The original threat model was around an attacker
replacing /dev/pts/$n or /dev/pts/ptmx with some malicious inode (a DoS
inode, or possibly a PTY they wanted a confused deputy to operate on).
Unfortunately, there was no practical way for runc to cache a safe
O_PATH handle to /dev/pts/ptmx (unlike other runtimes like LXC, which
switched to TIOCGPTPEER way back in 2017). Since it wasn't clear how we
could protect against the main attack TIOCGPTPEER was meant to protect
against, we never switched to it (even though I implemented it
specifically to harden container runtimes).
Unfortunately, It turns out that mount *sources* are a threat we didn't
fully consider. Since TIOCGPTPEER already solves this problem entirely
for us in a race free way, we should just use that. In a later patch, we
will add some hardening for /dev/pts/$num opening to maintain support
for very old kernels (Linux 4.13 is very old at this point, but RHEL 7
is still kicking and is stuck on Linux 3.10).
Fixes: GHSA-qw9x-cqr3-wc7r CVE-2025-52565
Reported-by: Lei Wang <ssst0n3@gmail.com> (CVE-2025-52565)
Reported-by: lfbzhm <lifubang@acmcoder.com> (CVE-2025-52565)
Reported-by: Aleksa Sarai <cyphar@cyphar.com> (TIOCGPTPEER)
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
65 lines
1.5 KiB
Go
65 lines
1.5 KiB
Go
package libcontainer
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"runtime"
|
|
|
|
"github.com/containerd/console"
|
|
"golang.org/x/sys/unix"
|
|
|
|
"github.com/opencontainers/runc/internal/linux"
|
|
)
|
|
|
|
// safeAllocPty returns a new (ptmx, peer pty) allocation for use inside a
|
|
// container.
|
|
func safeAllocPty() (pty console.Console, peer *os.File, Err error) {
|
|
pty, unsafePeerPath, err := console.NewPty()
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
defer func() {
|
|
if Err != nil {
|
|
_ = pty.Close()
|
|
}
|
|
}()
|
|
|
|
peer, err = linux.GetPtyPeer(pty.Fd(), unsafePeerPath, unix.O_RDWR|unix.O_NOCTTY)
|
|
if err != nil {
|
|
return nil, nil, fmt.Errorf("failed to get peer end of newly-allocated console: %w", err)
|
|
}
|
|
return pty, peer, nil
|
|
}
|
|
|
|
// mountConsole bind-mounts the provided pty on top of /dev/console so programs
|
|
// that operate on /dev/console operate on the correct container pty.
|
|
func mountConsole(peerPty *os.File) error {
|
|
f, err := os.Create("/dev/console")
|
|
if err != nil && !os.IsExist(err) {
|
|
return err
|
|
}
|
|
if f != nil {
|
|
// Ensure permission bits (can be different because of umask).
|
|
if err := f.Chmod(0o666); err != nil {
|
|
return err
|
|
}
|
|
f.Close()
|
|
}
|
|
mntSrc := &mountSource{
|
|
Type: mountSourcePlain,
|
|
file: peerPty,
|
|
}
|
|
return mountViaFds(peerPty.Name(), mntSrc, "/dev/console", "", "bind", unix.MS_BIND, "")
|
|
}
|
|
|
|
// dupStdio replaces stdio with the given peerPty.
|
|
func dupStdio(peerPty *os.File) error {
|
|
for _, i := range []int{0, 1, 2} {
|
|
if err := linux.Dup3(int(peerPty.Fd()), i, 0); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
runtime.KeepAlive(peerPty)
|
|
return nil
|
|
}
|