Hello and welcome to the Friday, July 28, 2003 edition of the Sands and its Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Researchers from WISIO disclosed two vulnerabilities in the Ubuntu implementation of Overlay FS. The overlay file system is often used

in containers, and while this is at its root, privilege escalation vulnerability, it's still

somewhat exciting, even though it's just privilege escalation, because it could affect container payloads

and how users running these payloads may be able to then break out into the host after

escalating privileges within the container. Ovalry file system is often used with containers

because it does allow a static base image to be used,

and then changes to the file system, like if you add a file or move something, that's being tracked

in a second layer so you don't actually modify the underlying file system. But this is exactly sort of where the problem

comes in here. One of the features that Linux provides is capabilities. You may have used

it, for example, with tools like TCPDump, where you do allow users to use TisB dump to capture

network packets, but that's where the only capability that you assign to TisBidam,

so that way it's a little bit safer than using, for example, Sudo, which is sort of notoriously

difficult to manage. The problem with the Ubuntu implementation of overlay file system is

that if you are moving a file from the underlying static file system into the

user layer of the file system, well, you can actually have these capabilities altered,

which then gives the user full route access to the system by essentially just adding all the capabilities to the particular

binary. The reason only Ubuntu is affected by this is that there was actually a similar

one of the least a couple years ago in the function that manages capabilities, but Ubuntu

made a modification to that particular function. It made its own copy of the function.

So the patch was never really applied to the Ubuntu version of it.

...