Skip to content

Fix CVE-2019-14271 loading of nsswitch based config inside chroot under Glibc#39612

Merged
AkihiroSuda merged 1 commit intomoby:masterfrom
tiborvass:cve-2019-14271
Jul 26, 2019
Merged

Fix CVE-2019-14271 loading of nsswitch based config inside chroot under Glibc#39612
AkihiroSuda merged 1 commit intomoby:masterfrom
tiborvass:cve-2019-14271

Conversation

@tiborvass
Copy link
Copy Markdown
Contributor

@tiborvass tiborvass commented Jul 26, 2019

Initialize nss libraries in Glibc so that the dynamic libraries are loaded in the host environment not in the chroot from untrusted files.

CVE-2019-14271 may allow unprivileged access to host system while copying files from a malicious container image with docker cp command.

Affected versions: v19.03.0. Older Docker versions are not affected by this issue.

This fix is included in the already released Docker v19.03.1. Users of Docker v19.03.0 are advised to upgrade.

The patch was previously reviewed internally by maintainers under GitHub security advisory.
If you find security issues in Moby, please follow responsible disclosure guidelines by sending an email to [email protected].

@justincormack
Initialize nss libraries in Glibc so that the dynamic libraries are l…
a316b10 
…oaded in the host

environment not in the chroot from untrusted files.

See also OpenVZ https://github.com/kolyshkin/vzctl/blob/a3f732ef751998913fcf0a11b3e05236b51fd7e9/src/enter.c#L227-L234

Signed-off-by: Justin Cormack <[email protected]>
(cherry picked from commit cea6dca993c2b4cfa99b1e7a19ca134c8ebc236b)
Signed-off-by: Tibor Vass <[email protected]>
andrewhsu
andrewhsu approved these changes Jul 26, 2019
View reviewed changes
Copy link
Copy Markdown
Contributor

@andrewhsu andrewhsu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

thaJeztah
thaJeztah approved these changes Jul 26, 2019
View reviewed changes
Copy link
Copy Markdown
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thaJeztah
Copy link
Copy Markdown
Member

thaJeztah commented Jul 26, 2019

@tiborvass fixes #39449 ?

@thaJeztah
Copy link
Copy Markdown
Member

thaJeztah commented Jul 26, 2019

@moby/moby-maintainers ptal

cpuguy83
cpuguy83 approved these changes Jul 26, 2019
View reviewed changes
Copy link
Copy Markdown
Member

@cpuguy83 cpuguy83 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

yongtang
yongtang approved these changes Jul 26, 2019
View reviewed changes
Copy link
Copy Markdown
Member

@yongtang yongtang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@AkihiroSuda AkihiroSuda merged commit 11e48ba into moby:master Jul 26, 2019
@justincormack justincormack mentioned this pull request Jul 26, 2019
Closed
@tonistiigi
Copy link
Copy Markdown
Member

tonistiigi commented Jul 26, 2019

@thaJeztah Just a reminder that this still needs to be cherry-picked to 18.09 tree

@thaJeztah
Copy link
Copy Markdown
Member

thaJeztah commented Jul 26, 2019

@tonistiigi if you can prepare a cherry-pick, I can LGTM 😉 😇

@tonistiigi tonistiigi mentioned this pull request Jul 26, 2019
Merged
@carnil
Copy link
Copy Markdown

carnil commented Aug 4, 2019 •
edited
Loading

@tonistiigi, @thaJeztah: In #39612 (comment) it is said that this affects only 19.03.0 series. But then the #39612 (comment) mentions the fix needs to be cherry-picked to 18.09 tree. So what is right? Are any older versions as well affected by this issue? Where was the issue introduced?

docker-archive#305 (comment) gives the information htat 18.09 needs the fix as well.

@thaJeztah
Copy link
Copy Markdown
Member

thaJeztah commented Aug 4, 2019

current versions of 18.09 are not affected because they are still using Go 1.10, and a custom archive implementation.

The 18.09 release branch was recently updated to Go 1.11 (which also removed the custom archive implementation), but no release was done yet with that code, but we had to backport the fix to prevent the next patch release being vulnerable

@carnil
Copy link
Copy Markdown

carnil commented Aug 4, 2019

@thaJeztah, ack thank you

@tonistiigi tonistiigi mentioned this pull request Sep 3, 2019
Closed
@thaJeztah thaJeztah mentioned this pull request Mar 11, 2020
Closed
@thaJeztah thaJeztah added this to the 20.03.0 milestone Apr 2, 2020
@Vogtinator Vogtinator mentioned this pull request Oct 7, 2020
Merged
This was referenced Nov 3, 2020
Merged
Merged
Merged
julianladisch added a commit to julianladisch/folio-tools that referenced this pull request May 17, 2021
@julianladisch
FOLIO-3163: Update jenkins-slave-docker/Dockerfile.focal-java-11
1241d4f 
* Update Ansible from 2.9.13 to 2.9.21 fixing security issues:
  * https://access.redhat.com/security/cve/cve-2021-2022 - Mask default and fallback values for `no_log` module options
  * https://access.redhat.com/security/cve/cve-2021-20191 - Various modules missing `no_log` on sensitive module arguments
  * https://access.redhat.com/security/cve/cve-2021-20180 - `bitbucket_pipeline_variable` - hide user sensitive information which are marked as `secured` from logging into the console
  * https://access.redhat.com/security/cve/cve-2021-20178 - `snmp_facts` - hide user sensitive information such as ``privkey`` and ``authkey`` from logging into the console
  * https://access.redhat.com/security/cve/cve-2020-1753 - kubectl connection plugin - now redacts `kubectl_token` and `kubectl_password` in console log

* Update Docker from 19.03.9 to 20.10.6 fixing
  * CVE-2021-21285 Prevent an invalid image from crashing docker daemon GHSA-6fj5-m822-rqx8
  * CVE-2021-21284 Lock down file permissions to prevent remapped root from accessing docker state GHSA-7452-xqpj-6rpc
  * CVE-2019-14271 loading of nsswitch based config inside chroot under Glibc moby/moby#39612
  * CVE-2020-15257 Update bundled static binaries of containerd to v1.3.9 GHSA-36xw-fx78-c5r4

* Update Yarn from 1.22.4 to 1.22.5, to the classic stable version: https://classic.yarnpkg.com/lang/en/

* The re-build also updates many other tools, most notably Node:

* Update Node from 12.20.1 to 12.22.1 fixing
  * https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/ OpenSSL - CA certificate check bypass with `X509_V_FLAG_X509_STRICT` (CVE-2021-3450)
  * https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/ OpenSSL - NULL pointer deref in signature_algorithms processing (CVE-2021-3449)
  * https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/ npm upgrade - Update y18n to fix Prototype-Pollution (CVE-2020-7774)
  * https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion (CVE-2021-22883)
  * https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ DNS rebinding in --inspect (CVE-2021-22884)
  * https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/ OpenSSL - Integer overflow in CipherUpdate (CVE-2021-23840)
@julianladisch julianladisch mentioned this pull request May 17, 2021
Merged
@shraddhapai
Copy link
Copy Markdown

shraddhapai commented May 26, 2021

Hi all, I'm running into the docker cp error with docker 19.03.6 running on Ubuntu 18.04.5 LTS.

This is what I get as output:

Error response from daemon: error processing tar file: docker-tar: relocation error: /lib/x86_64-linux-gnu/libnss_files.so.2: symbol __libc_readline_unlocked version GLIBC_PRIVATE not defined in file libc.so.6 with link time reference
: exit status 127

Any help would be appreciated, thanks!

@thaJeztah
Copy link
Copy Markdown
Member

thaJeztah commented May 26, 2021

@shraddhapai is that package a docker-ce package installed from download.docker.com or is it a package installed from the Ubuntu's distro packages?

@corhere corhere mentioned this pull request Jan 18, 2022
Closed
@thaJeztah thaJeztah mentioned this pull request Dec 20, 2024
Merged
@thaJeztah thaJeztah mentioned this pull request Apr 28, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cpuguy83 cpuguy83 cpuguy83 approved these changes

@thaJeztah thaJeztah thaJeztah approved these changes

@AkihiroSuda AkihiroSuda AkihiroSuda approved these changes

+2 more reviewers

@andrewhsu andrewhsu andrewhsu approved these changes

@yongtang yongtang yongtang approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

area/security impact/changelog process/cherry-picked status/4-merge

Projects

None yet

Milestone

20.10.0

Development

Successfully merging this pull request may close these issues.