关联漏洞
标题：
containerd 安全漏洞
(CVE-2020-15257)
描述：containerd是美国阿帕奇（Apache）基金会的一个容器守护进程。该进程根据 RunC OCI 规范负责控制宿主机上容器的完整周期。 containerd 1.3.9之前版本和1.4.3版本存在安全漏洞，该漏洞源于containerd-shim API被不正确地公开给主机网络容器。shim s API套接字的访问控制验证了连接进程的有效UID为0，但是没有限制对抽象Unix域套接字的访问。这将允许在与shim相同的网络名称空间中运行的恶意容器，其有效UID为0，但在其他方面减少了特权，从而导致使用
描述
Proof of concept for CVE-2020-15257 in containerd.
介绍
# ABSTRACT SHIMMER (CVE-2020-15257)
This repo contains proof-of-concept exploit code for CVE-2020-15257 as
described in [our blog post](https://research.nccgroup.com/2020/12/10/abstract-shimmer-cve-2020-15257-host-networking-is-root-equivalent-again/).
While written for containerd 1.2.x and 1.3.x, it should work on pre-patch
versions of containerd 1.4.x.
```
$ go build
```
```
$ docker build -t abstractshimmer .
$ docker run --rm -d --network host abstractshimmer | xargs docker logs -f
```
```
$ cat /tmp/shimmer.out
$ cat /tmp/shimmer.binary
$ # or, for containerd 1.2.x
$ cat /etc/crontab
```
***Note:*** This exploit will leave Docker/containerd a bit out of sorts. There
will be a dangling containerd-shim and Docker container that need to be killed
and `docker rm --force`'d respectively to clean things up a bit.
/var/lib/containerd/io.containerd.runtime.v1.linux/moby/ and
/run/containerd/io.containerd.runtime.v1.linux/moby/ will have some leftovers
as well. As part of this, this exploit does not attempt to reconcile
containerd's `address` files. This may lead to issues where attempting to
update a vulnerable system after exploiting it will result in Docker/containerd
failing to restart cleanly and/or being unable to see existing containers. If
you observe this while updating your containerd package, it may be an indicator
that the system has been previously compromised by some variant of this
exploit.
文件快照
[4.0K] /data/pocs/20ec253449c2a53a5a667152a1690c29ffd40566
├── [ 173] Dockerfile
├── [ 317] go.mod
├── [7.0K] go.sum
├── [ 11K] LICENSE
├── [9.6K] main.go
└── [1.4K] README.md
0 directories, 6 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。