Improper File Access in Google gVisor via CUSE

Executive Summary

This vulnerability is an improper exposure of a resource to the wrong sphere in the host file helper (gofer) component of Google gVisor. It affects Linux platforms with CUSE enabled and allows a local attacker with container image deployment privileges to gain root code execution on the host system. The attacker can include a /dev/cuse character device node in a container image, which passes through to the host when opened. This enables the attacker to register a host device and exploit unrestricted ioctl handling to overwrite root udev helper memory.

Useful 0 Not Useful 0

Impact Analysis

If you use Google gVisor with CUSE enabled on a Linux system, an attacker with container image deployment privileges could exploit this flaw to gain root access on your host system. This could lead to full system compromise, allowing the attacker to execute arbitrary code, steal data, install malware, or perform other malicious activities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. If an attacker gains root access, they could exfiltrate or manipulate protected data, resulting in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update gVisor to commit 573a9e73cf844f or later to address the improper exposure of resource to wrong sphere in the host file helper (gofer). Disable CUSE in your environment if not required, as this vulnerability specifically targets systems with CUSE enabled.

Useful 0 Not Useful 0