Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

securityaffairs.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

#11

Post by awithrow »

radus wrote: post #9
compsciphd wrote: post #6

Are there really good use cases for dockerd being exposed to the network? I would assume (many/most) users who run docker directly run it without api access on the network (i.e. on a single host). Even those that do want network deployments of docker, probably run it through something like k8s where again kubernetes is handling the networking side, and each dockerd doesn't need to expose a network accessible api). ju…

Example: you want to set your local docker context to the production environment, so that when you type `docker system prune --volumes` you delete your production data.

Honestly this sounds like a massive outage waiting to happen

Re: Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

#12

Post by rudasn »

radus wrote: post #9
compsciphd wrote: post #6

Are there really good use cases for dockerd being exposed to the network? I would assume (many/most) users who run docker directly run it without api access on the network (i.e. on a single host). Even those that do want network deployments of docker, probably run it through something like k8s where again kubernetes is handling the networking side, and each dockerd doesn't need to expose a network accessible api). ju…

Example: you want to set your local docker context to the production environment, so that when you type `docker system prune --volumes` you delete your production data.

Right? I always wondered who would use that feature and for what, now it all makes sense!

Re: Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

#13

Post by hibbelig »

compsciphd wrote: post #6

Are there really good use cases for dockerd being exposed to the network? I would assume (many/most) users who run docker directly run it without api access on the network (i.e. on a single host). Even those that do want network deployments of docker, probably run it through something like k8s where again kubernetes is handling the networking side, and each dockerd doesn't need to expose a network accessible api). ju…

Docker desktop for Mac: dockerd runs in the VM and the client from the host system wants to connect. But of course we all hope that the network it is exposed to is still only on the Mac.

Re: Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

#14

Post by chatmasta »

compsciphd wrote: post #6

Are there really good use cases for dockerd being exposed to the network? I would assume (many/most) users who run docker directly run it without api access on the network (i.e. on a single host). Even those that do want network deployments of docker, probably run it through something like k8s where again kubernetes is handling the networking side, and each dockerd doesn't need to expose a network accessible api). ju…

The issues arise when “the network” means something different at deployment time. You might plan or expect “the network” to be shared only by local services. But then you add some management GUI that needs access to it. And then you add a sidecar to that. And before you know it, you’ve got a bunch of containers, all with their own attack surface, and all with access to the dockerd socket.

Re: Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

#15

Post by hotsauceror »

awithrow wrote: post #11
radus wrote: post #9

Earlier quoted context omitted.

Example: you want to set your local docker context to the production environment, so that when you type `docker system prune --volumes` you delete your production data.

Honestly this sounds like a massive outage waiting to happen

That’s Ops’s problem later tonight. You have to move fast and break things.

Re: Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

#16

Post by m463 »

compsciphd wrote: post #6

Are there really good use cases for dockerd being exposed to the network? I would assume (many/most) users who run docker directly run it without api access on the network (i.e. on a single host). Even those that do want network deployments of docker, probably run it through something like k8s where again kubernetes is handling the networking side, and each dockerd doesn't need to expose a network accessible api). ju…

related, note that docker will money with the firewall and let itself through unexpectedly:

https://vpetersson.com/2014/11/03/the-dangers-of-ufw-docker....

Re: Critical Bug in Docker Engine Allowed Attackers to Bypass Authorization Plugins

#17

Post by broknbottle »

erickj wrote: post #5

Hmmm... It's as though running root privelege daemons with open sockets could go wrong. Who could have known. https://developers.redhat.com/blog/2020/09/25/rootless-conta...

Hmm it’s as though Linux is living in dark ages and having a root be a special user could result in something going wrong. Perhaps Lennart will come will return to Red Hat after his stint at Microsoft and introduce SecureTokens
Post reply on HN