Improper access control in containerd - CVE-2020-15257

Vulnerability identifier: #VU48795

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-15257

CWE-ID: CWE-284

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges.

containerd
Storage Ceph
Gentoo Linux
Arch Linux
Ubuntu
openEuler
Fedora
containerd (Alpine package)
docker.io (Debian package)
docker (Alpine package)
containerd
containerd (Ubuntu package)
golang-github-docker-containerd-dev (Ubuntu package)
golang-github-containerd-containerd-dev (Ubuntu package)
IBM MQ Operator
Red Hat OpenStack

Install updates from vendor's website.

containerd - addressed in versions 1.3.9, 1.4.3
containerd (Alpine package) - update to 1.4.3-r0
IBM MQ Operator - update to 2.0.0
docker.io (Debian package) - update to 18.09.1+dfsg1-7.1+deb10u3
docker (Alpine package) - update to 19.03.14-r0
containerd - update to 1.2.0-102
containerd (Ubuntu package) - addressed in versions 1.2.6-0ubuntu1~16.04.5, 1.2.6-0ubuntu1~16.04.6, 1.3.3-0ubuntu1~18.04.3, 1.3.3-0ubuntu1~18.04.4, 1.3.3-0ubuntu2.1, 1.3.3-0ubuntu2.2, 1.3.7-0ubuntu3.1, 1.3.7-0ubuntu3.2
golang-github-docker-containerd-dev (Ubuntu package) - addressed in versions 1.2.6-0ubuntu1~16.04.6, 1.3.3-0ubuntu1~18.04.4, 1.3.3-0ubuntu2.2
golang-github-containerd-containerd-dev (Ubuntu package) - update to 1.3.7-0ubuntu3.2
containerd - update to 1.4.3-1.fc33
Storage Ceph - update to 7.1
Red Hat OpenStack - update to 16.2

• Exploit #5032 - abstractshimmer (Proof of concept for CVE-2020-15257 in containerd.) (January 18, 2021)

• https://github.com/containerd/containerd/commit/4a4bb851f5da563ff6e68a83dc837c7699c469ad
• https://github.com/containerd/containerd/releases/tag/v1.4.3
• https://github.com/containerd/containerd/security/advisories/GHSA-36xw-fx78-c5r4

• Privilege escalation in containerd
• Arch Linux update for containerd
• Improper access control in docker (Alpine package)
• Improper access control in containerd (Alpine package)
• Debian update for docker.io
• Gentoo update for containerd
• Ubuntu update for containerd
• Multiple vulnerabilities in IBM MQ Operator
• openEuler 20.03 LTS update for containerd
• Multiple vulnerabilities in IBM Storage Ceph
• Multiple vulnerabilities in Red Hat OpenStack 16.2 packages
• Ubuntu update for containerd
• Fedora 33 update for containerd