How To Fix CVE-2022-0492- Privilege Escalation And Container Escape Vulnerabilities In Cgroups

A new vulnerability has been spotted recently in the Linux Control group, a Linux kernel feature that allows processes to be organized into hierarchical groups. The vulnerability is tracked as CVE-2022-0492 is a High severity vulnerability with a CVSS score of 7.0. This vulnerability allows adversaries to escape containers and could perform arbitrary command execution on the host machine. Users of containers should know about this vulnerability and fix them up as soon as possible. We have created this post to help users to learn how to fix CVE-2022-0492- Privilege escalation and container escape vulnerabilities in Cgroup.

Before we dive into fixing the vulnerability, let’s understand some basics about Cgroups.

What Is Cgroups?

Control groups, referred to as cgroups, are a Linux kernel feature that allows organized processes into hierarchical groups. This feature made it a perfect building block of containers and allowed administrators to limit and isolate the resource usage of a collection of processes. Linux systems support two architectures of Cgroup, (1) v1 and (2) v2. The CVE-2022-0492 vulnerability exists in v1, which is the most prevalent architecture as of. 

What Is Cgroupfs?

Cgroup is a pseudo-filesystem used as an interface to manage Cgroups. It is mounted under /sys/fs/cgroup, which is the root directory of Cgroupfs. Cgroups are divided into several subsystems to manage different resources such as memory, CPU, block IO, remote direct memory access (RDMA). For example, memory subgroup mounted on /sys/fs/cgroup/memory is used to limit the memory consumption of a collection of processes, device subgroup mounted on /sys/fs/cgroup/device is used to defines which devices can be accessed by processes in the cgroup.

Each subsystems are mounted at /sys/fs/cgroup/<subsystem>. A directory under a subgroup is called child group. For example, a docker container mounted at at /sys/fs/cgroup/<subsystem>/docker/<ctr-id> is a child group of the subgroup. 

Summary Of CVE-2022-0492- Privilege Escalation And Container Escape Vulnerabilities In Cgroups:

As per the Unit 42, “At first glance, a privilege escalation vulnerability that can only be exploited by the root user may seem bizarre. In the past, this wouldn’t be considered a security issue. But today, running as root doesn’t necessarily mean full control over the machine: There’s a gray area between the root user and full privileges that include capabilities, namespaces, and containers. In these scenarios where a root process doesn’t have full control over the machine, CVE-2022-0492 becomes a serious vulnerability”.

Unit 42- Palo Alto

Containers Vulnerable To CVE-2022-0492- Privilege Escalation And Container Escape Vulnerability In Cgroups:

The flaw doesn’t affect all the containers. The flaw can be exploited only in some circumstances.

1. The container should have the v1 architecture of cgroups.
2. Root privilege without the no_new_privs flag set.
3. Container with disabled AppArmor or SELinux and without Seccomp features.
4. On a host that enables unprivileged user namespaces.

Or 

1. The container should have the v1 architecture of cgroups.
2. The container with CAP_SYS_ADMIN capability enabled.
3. Container with disabled AppArmor or SELinux and without Seccomp features.
4. Container without cgroup namespaces.

How To Test Your Container Is Vulnerable to CVE-2022-0492?

Researchers from Palo Alto’s unit 42 team has developed a script to test whether your container is vulnerable to CVE-2022-0492. You should need to pull and run the pre-build image us-central1-ocker.pkg.dev/twistlock-secresearch/public/can-ctr-escape-cve-2022-0492:latest from public repository. The container will tell you as soon as you run the image.

# Run this command to pull the container image:
$ sudo docker pull us-central1-docker.pkg.dev/twistlock-secresearch/public/can-ctr-escape-cve-2022-0492:latest

# Run this command to run the container image:
$ sudo docker run us-central1-docker.pkg.dev/twistlock-secresearch/public/can-ctr-escape-cve-2022-0492:latest

Further checks to determine the container is vulnerable to CVE-2022-0492:

Run the container by tweaking the configurations of AppArmor or SELinux and Seccomp features.

$ sudo docker run --rm -it --cap-add sys_admin us-central1-docker.pkg.dev/twistlock-secresearch/public/can-ctr-escape-cve-2022-0492:latest

$ sudo docker run --rm -it --cap-add sys_admin --security-opt apparmor=unconfined us-central1-docker.pkg.dev/twistlock-secresearch/public/can-ctr-escape-cve-2022-0492:latest

$ sudo docker run --rm -it --security-opt apparmor=unconfined --security-opt seccomp=unconfined us-central1-docker.pkg.dev/twistlock-secresearch/public/can-ctr-escape-cve-2022-0492:latest

In this scenario, we can clearly say that our container is vulnerable to the flaw. It is just protected by AppArmor or SELinux and Seccomp features.

How To Fix CVE-2022-0492- Privilege Escalation And Container Escape Vulnerabilities In Cgroups?

The flaw is patched in the latest version of the kernel. All are encouraged to upgrade to the latest kernel. Please contact your vendor or Linux distributions to get the latest versions.

In the previous session, we can say that the container is vulnerable to the flaw. It is just protected by AppArmor or SELinux and Seccomp features. Keep the AppArmor or SELinux and Seccomp features enabled until there is a permanent fix.

General mitigations are:

1. Enable AppArmor or SELinux on Kubernetes.
2. Enable Seccomp on Kubernetes.
3. In a case of privilege escalation due to a malicious host process, you may need to disable unprivileged user namespaces using this command:
   $ sudo sysctl -w kernel.unprivileged_userns_clone=0
4. Palo Alto developed a script to prevent processes from setting the release_agent in any cgroup mount. This script masks all release_agent files with a read-only bind mount. If your system mounts cgroups at a different path, provide the path as an argument to the script.

#!/bin/bash
set -e
 
mask_dir=/var/lib/cve_2022_0492_release_agent_mask
cgroup_dir=/sys/fs/cgroup
if [ ! -z "$1" ]; then cgroup_dir=$1 ; fi
 
echo "[+] Creating mask at $mask_dir/mask"
sudo mkdir -p $mask_dir
sudo mount -t tmpfs release_agent_mask $mask_dir
sudo touch $mask_dir/mask
sudo mount -o remount,ro $mask_dir
 
for release_agent in $(find $cgroup_dir -name 'release_agent') ;do 
    echo "[+] Mounting read-only mask over $release_agent"
    sudo mount --bind $mask_dir/mask $release_agent
done

How To Upgrade Kernel On Your Linux?

There are multiple ways to update the kernel on Linux. The best and the native way is to download and install the tested kernel package. Please contact your support to choose the best way that works for you. Just for the demonstration, we are going to show you how to upgrade the kernel on Ubuntu or Debian servers in a native way.

We hope this post will help you in knowing How to Fix CVE-2022-0492- Privilege Escalation and Container Escape Vulnerabilities in Cgroups. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.

• Step By Step Procedure To Fix The New Sudo Vulnerability (CVE-2021-3156)
• How To Partition And Format The Hard Drives On Raspberry Pi?
• Be Aware Of This New Windows Container Malware “Siloscape” Targeting Kubernetes Clusters
• How To Fix CVE-2021-43267- A Heap Overflow Vulnerability In Linux Kernel’s TIPC Module
• 5 Best Open-Source Tools To Monitor Containers