Executive Summary

This vulnerability is a container privilege escalation flaw in KServe ModelMesh container images. It occurs because the /etc/passwd file is created with group-writable permissions during the container build process. An attacker who can run commands inside the container as a non-root user but is part of the root group can modify the /etc/passwd file. By doing so, the attacker can add a new user with any user ID, including UID 0, which grants full root privileges within the container. [1]

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker with limited access inside the container to escalate their privileges to full root access. This means the attacker can gain complete control over the container environment, potentially leading to unauthorized actions, data manipulation, or further attacks within the containerized system. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking the permissions of the /etc/passwd file inside the container images. Specifically, look for group-writable permissions on /etc/passwd. For example, run the command: ls -l /etc/passwd. If the permissions show group-writable (e.g., -rw-rw-r--), the container is vulnerable. Additionally, verify if any non-root users inside the container are members of the root group by running: groups <username>. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include rebuilding the affected container images ensuring that /etc/passwd is created without group-writable permissions (e.g., permissions set to 644 or stricter). Also, restrict membership of non-root users from the root group inside containers. Applying updated container images or patches provided by the vendor as soon as they are available is recommended. [1]

Useful 0 Not Useful 0