分类

Posted in

Docker 安全公告：Docker 引擎中的授权插件绕过漏洞_AI阅读总结 — 包阅AI

by baoyueai

包阅导读总结

1. `Docker Engine`、`AuthZ Plugin`、`Bypass Regression`、`Security Vulnerability`、`Remediation Steps`

2. 核心信息：Docker Engine 存在 AuthZ Plugin 绕过回归的安全漏洞，特定版本受影响，攻击者利用此漏洞可能绕过授权，存在特权升级风险。已提供受影响版本、修复版本及修复步骤。

3.

– Docker Engine 存在 AuthZ Plugin 绕过回归的安全漏洞

– 某些版本的 Docker Engine 存在安全漏洞，攻击者在特定情况下可绕过授权插件

– 漏洞详情

– 攻击者可利用 API 请求的 Content-Length 为 0 绕过

– 2019 年曾修复但未延续到后续版本，2024 年 7 月 23 日发布补丁

– 受影响版本及修复版本

– 受影响版本包括多个

– 修复版本高于特定版本

– 受影响情况

– 依赖授权插件做访问控制决策的用户受影响

– 部分用户不受影响

– 对 Docker Desktop 的影响

– 部分版本包含受影响的 Docker Engine

– 影响有限，Desktop 4.33 包含补丁

– 修复步骤

– 更新 Docker Engine 和 Docker Desktop

– 无法立即更新的缓解措施

4.

思维导图：

文章地址：https://www.docker.com/blog/docker-security-advisory-docker-engine-authz-plugin/

文章来源：docker.com

作者：Gabriela Georgieva

发布时间：2024/7/30 5:37

语言：英文

总字数：554字

预计阅读时间：3分钟

评分：84分

标签：Docker 安全,授权插件绕过,权限升级,Docker 引擎,安全公告

以下为原文内容

本内容来源于用户推荐转载，旨在分享知识与观点，如有侵权请联系删除 联系邮箱 media@ilingban.com

Docker Security Advisory: AuthZ Plugin Bypass Regression in Docker Engine

Certain versions of Docker Engine have a security vulnerability that could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The base likelihood of this being exploited is low. This advisory outlines the issue, identifies the affected versions, and provides remediation steps for impacted users.

Banner docker security advisory

Problem

Docker’s default authorization model is all-or-nothing. Users with access to the Docker daemon can execute any Docker command. For greater access control, authorization plugins (AuthZ) can be used. These plugins approve or deny requests to the Docker daemon based on authentication and command context.

In 2018, a security issue was discovered where an attacker could bypass AuthZ plugins using a specially crafted API request. This could lead to unauthorized actions, including privilege escalation. Although this issue was fixed in Docker Engine v18.09.1 in January 2019, the fix was not carried forward to later versions, resulting in a regression.

Vulnerability details

  • AuthZ bypass and privilege escalation: An attacker could exploit a bypass using an API request with Content-Length set to 0, causing the Docker daemon to forward the request without the body to the AuthZ plugin, which might approve the request incorrectlyif not set to deny by default.
  • Initial fix: The issue was fixed in Docker Engine v18.09.1 January 2019.
  • Regression: The fix was not included in Docker Engine v19.03 or newer versions. This was identified in April 2024 and patches were released for the affected versions on July 23, 2024. The issue was assigned CVE-2024-41110.

Affected versions

Affected versions Patched versions
<= v19.03.15, <= v20.10.27, <= v23.0.14, <= v24.0.9, <= v25.0.5, <= v26.0.2, <= v26.1.4, <= v27.0.3, <= v27.1.0 > v23.0.14, >26.1.4, > v27.1.0

Who is impacted?

  • Users of Docker Engine v19.03.x and later versions who rely on authorization plugins to make access control decisions.

Who is not impacted?

  • Users of Docker Engine v19.03.x and later versions who do not rely on authorization plugins to make access control decisions and users of all versions of Mirantis Container Runtime are not vulnerable.
  • Users of Docker commercial products and internal infrastructure who do not rely on AuthZ plugins are unaffected.

Impact on Docker Desktop

  • Docker Desktop up to v4.32.0 includes affected versions of Docker Engine.
  • The impact for Docker Desktop is limited compared to production environments.
    • Exploitation requires access to the Docker API, which usually means the attacker needs to already have local access to the host machine, unless the Docker daemon is insecurely exposed over TCP.
    • Default Docker Desktop configuration does not include AuthZ plugins.
    • Privilege escalation is limited to the Docker Desktop VM, not the underlying host.
  • A patched version of Docker Engine is included in Docker Desktop 4.33.

Remediation steps

  1. Update Docker Engine:
  • If you are running an affected version, update to the most recent patched version.
  1. Mitigation if unable to update immediately:
  • Avoid using AuthZ plugins.
  • Restrict access to the Docker API to trusted parties, following the principle of least privilege.
  1. Update Docker Desktop:
  • If using an affected version, update to Docker Desktop 4.33 .
  • Ensure AuthZ plugins are not used and do not expose the Docker API over TCP without protection.
  • Docker Business subscribers can use Settings Management to enforce secure settings.

Learn more