====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN322
_____________________________________________________________________

DATE                : 09/06/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Docker versions prior to 19.03.11.

=====================================================================
https://docs.docker.com/engine/release-notes/
_____________________________________________________________________

Version 19.03

19.03.11

2020-06-01


Network

Disable IPv6 Router Advertisements to prevent address spoofing.
CVE-2020-13401


Description

In the Docker default configuration, the container network interface is
a virtual ethernet link going to the host (veth interface). In this
configuration, an attacker able to run a process as root in a container
can send and receive arbitrary packets to the host using the CAP_NET_RAW
capability (present in the default configuration).

If IPv6 is not totally disabled on the host (via ipv6.disable=1 on the
kernel cmdline), it will be either unconfigured or configured on some
interfaces, but it’s pretty likely that ipv6 forwarding is disabled,
that is, /proc/sys/net/ipv6/conf//forwarding == 0. Also by default,
/proc/sys/net/ipv6/conf//accept_ra == 1. The combination of these 2
sysctls means that the host accepts router advertisements and configures
the IPv6 stack using them.

By sending “rogue” router advertisements from a container, an attacker
can reconfigure the host to redirect part or all of the IPv6 traffic of
the host to the attacker-controlled container.

Even if there was no IPv6 traffic before, if the DNS returns A (IPv4)
and AAAA (IPv6) records, many HTTP libraries will try to connect via
IPv6 first then fallback to IPv4, giving an opportunity to the attacker
to respond. If by chance the host has a vulnerability like last year’s
RCE in apt (CVE-2019-3462), the attacker can now escalate to the host.

As CAP_NET_ADMIN is not present by default for Docker containers, the
attacker can’t configure the IPs they want to MitM, they can’t use
iptables to NAT or REDIRECT the traffic, and they can’t use
IP_TRANSPARENT. The attacker can however still use CAP_NET_RAW and
implement a tcp/ip stack in user space.

See kubernetes/kubernetes#91507 for related issues.


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================