util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target container

Impact

nsenter --join-cgroup opens the target's cgroup.procs as root and keeps that descriptor open across the later namespace and credential changes and across execve(). The kernel authorises subsequent cgroup migrations using the credentials from the original open, so code running in the target inherits root's ability to move host processes between cgroups. After an operator uses --join-cgroup against a container a tenant controls, an unprivileged process in that container can migrate and then terminate unrelated root processes on the node. On a GPU node that means kubelet, the container runtime, the exporter and the driver's persistence daemon are all reachable targets, which is an availability problem on hardware that is expensive to drain. The vector records no confidentiality impact; this is integrity and availability.

Who can reach it

Local, and it needs a privileged operator to first run nsenter --join-cgroup against a container or process the attacker controls (the vector marks UI:R). After that the attacker needs only unprivileged code execution inside that target.

What to do

Take the util-linux update from your distribution. Red Hat tracks the issue for RHEL 7 through 10, Red Hat Hardened Images and OpenShift Container Platform 4; this record names no fixed upstream version, so check the vendor advisory for the build that carries the fix. nsenter is a userspace binary, so replacing the package is sufficient - no reboot and no node drain. In the meantime, do not use --join-cgroup when attaching to a container you do not trust.

References

Related entries

• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh
• Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsCVE-2014-3601 · Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pagesHigh
• ABRT: symlink attack on predictable core-dump paths gives local users root on RHEL hostsCVE-2015-5287 · ABRT abrt-hook-ccpp (core dump helper on RHEL/CentOS)High
• Linux kernel (mm, COW): Dirty COW: privilege escalation via MAP_PRIVATE COW breakageCVE-2016-5195 · Linux kernel (mm, COW)High
• Linux kernel VFIO drivers/vfio/pci/vfio_pci.c - VFIO_DEVICE_SET_IRQS ioctl: A state-machine confusion inCVE-2016-9083 · Linux kernel VFIO drivers/vfio/pci/vfio_pci.c - VFIO_DEVICE_SET_IRQS ioctlHigh
• Linux kernel VFIO drivers/vfio/pci/vfio_pci_intrs.c - MSI/MSI-X allocation: Sibling of CVE-2016-9083 in the sameCVE-2016-9084 · Linux kernel VFIO drivers/vfio/pci/vfio_pci_intrs.c - MSI/MSI-X allocationHigh