Описание
A flaw was found in fuse-overlayfs, a component used for rootless containers. This vulnerability allows a low-privileged process to retain SUID (Set User ID) and SGID (Set Group ID) permissions on files after they are truncated or opened with the O_TRUNC flag. This can enable a local attacker to manipulate file permissions, potentially leading to privilege escalation within the system.
Отчет
Red Hat is aware of this issue affecting fuse-overlayfs, which is used as an optional, non-default storage backend for rootless Podman/Buildah on kernels or configurations where native (kernel) overlayfs support for user namespaces is unavailable. On currently supported Red Hat Enterprise Linux releases (RHEL >= 8.5 / RHEL 9 / RHEL 10), rootless Podman uses native kernel overlayfs by default; fuse-overlayfs is only invoked as a fallback or when explicitly configured via storage.conf's mount_program option, or in nested/unprivileged container scenarios (e.g. rootless Buildah image builds) that lack CAP_SYS_ADMIN. Exploitation additionally requires a pre-existing file in the container's lower image layer that already carries the SUID or SGID bit and is writable by a low-privileged process, an atypical container image configuration. Red Hat rates the overall risk of this issue as reduced relative to a generic worst-case rating given these preconditions; see the private triage comment on this flaw for the full reachability and CVSS analysis.
Меры по смягчению последствий
Avoid configuring fuse-overlayfs as the storage mount_program for rootless Podman/Buildah where native overlayfs support is available (this is not the default on supported RHEL releases). Ensure container images do not ship world- or group-writable files with the SUID or SGID bit set. No other mitigation is available prior to upgrading to fuse-overlayfs >= 1.17.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | fuse-overlayfs | Fix deferred | ||
| Red Hat Enterprise Linux 8 | container-tools:rhel8/fuse-overlayfs | Fix deferred | ||
| Red Hat Enterprise Linux 9 | fuse-overlayfs | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | fuse-overlayfs | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | rhcos | Out of support scope |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.7 Medium
CVSS3
Связанные уязвимости
(fuse-overlayfs is an implementation of overlayfs in FUSE for rootless ...)
fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.
fuse-overlayfs is an implementation of overlayfs in FUSE for rootless ...
EPSS
4.7 Medium
CVSS3