Tweet
Tweet

Slide 1

Slide 1 text

October 17, 2018 Common Vulnerabilities & Exposures (CVE) In Docker Containers José Manuel Ortega @jmortegac

Slide 2

Slide 2 text

October 17, 2018 October 17, 2018 • Dockes images • Docker CVE and container threats • Container images scanning tools • NVD vulnerabilities & Vulners Agenda

Slide 3

Slide 3 text

October 17, 2018 October 17, 2018

Slide 4

Slide 4 text

October 17, 2018 October 17, 2018

Slide 5

Slide 5 text

October 17, 2018 October 17, 2018 • Checking the software packages, binaries, libraries, operative system files, against one or more well known vulnerabilities databases. • Analyzing the Dockerfile and image metadata to detect security sensitive configurations • User defined policies like software packages blacklists, base images whitelists. Container image scanning

Slide 6

Slide 6 text

October 17, 2018 October 17, 2018

Slide 7

Slide 7 text

October 17, 2018 October 17, 2018 Docker CVE https://www.docker.com/docker-cve-database

Slide 8

Slide 8 text

October 17, 2018 October 17, 2018 https://www.saucs.com/cve?vendor=docker

Slide 9

Slide 9 text

October 17, 2018 October 17, 2018 https://www.cvedetails.com/product/28125/Docker-Docker.html?vendor_id=13534

Slide 10

Slide 10 text

October 17, 2018 October 17, 2018

Slide 11

Slide 11 text

October 17, 2018 October 17, 2018 • The Dirty Cow exploit on the Linux kernel allowing root privilege escalation on a host or container. • OpenSSL heap corruption caused by malformed key header and a crash caused by the presence of a specific extension. • Buffer overflow in Ruby and Python libraries allowing execution of malicious code. • Vulnerabilities like the glibc stack-based buffer overflow • SQL injection attacks that put hackers in control of a database container in order to steal data Container threats

Slide 12

Slide 12 text

October 17, 2018 October 17, 2018

Slide 13

Slide 13 text

October 17, 2018 October 17, 2018

Slide 14

Slide 14 text

October 17, 2018 October 17, 2018

Slide 15

Slide 15 text

October 17, 2018 October 17, 2018

Slide 16

Slide 16 text

October 17, 2018 October 17, 2018 CVSS = Impact × Exploitability

Slide 17

Slide 17 text

October 17, 2018 October 17, 2018

Slide 18

Slide 18 text

October 17, 2018 October 17, 2018 DirtyCow https://security-tracker.debian.org/tracker/CVE-2016-5195

Slide 19

Slide 19 text

October 17, 2018 October 17, 2018 DirtyCow https://security-tracker.debian.org/tracker/CVE-2016-5195

Slide 20

Slide 20 text

October 17, 2018 October 17, 2018 DirtyCow https://github.com/gebl/dirtycow-docker-vdso

Slide 21

Slide 21 text

October 17, 2018 October 17, 2018 DirtyCow dockerfile

Slide 22

Slide 22 text

October 17, 2018 October 17, 2018 DirtyCow execution

Slide 23

Slide 23 text

October 17, 2018 October 17, 2018 Prevent DirtyCow with apparmor

Slide 24

Slide 24 text

October 17, 2018 October 17, 2018 Jack-in-the-Box" Vulnerability When Unpacking Images (CVE-2018-8115) • Patched in Community version (Docker CE 18.03.1 and Docker CE 17.05.0-rc1) • https://github.com/aquasecurity/scan-cve-2 018-8115

Slide 25

Slide 25 text

October 17, 2018 October 17, 2018 https://github.com/aquasecurity/scan-cve-2018-8115/blob/master/ verify.py

Slide 26

Slide 26 text

October 17, 2018 October 17, 2018 Most vulnerable packages

Slide 27

Slide 27 text

October 17, 2018 October 17, 2018 • CoreOS/Clair(Ubuntu CVE Tracker Debian Security Bug Tracker, Red Hat Security Data) • Anchore Engine • Dagda Container image scanning open-source tools

Slide 28

Slide 28 text

October 17, 2018 October 17, 2018

Slide 29

Slide 29 text

October 17, 2018 October 17, 2018

Slide 30

Slide 30 text

October 17, 2018 October 17, 2018 $ docker exec clair_clair analyzer

Slide 31

Slide 31 text

October 17, 2018 October 17, 2018 • Extract build, installed packages, and other system’s information • Scan images for known vulnerabilities with anchore CLI Anchore engine

Slide 32

Slide 32 text

October 17, 2018 October 17, 2018 Anchore engine

Slide 33

Slide 33 text

October 17, 2018 October 17, 2018 Anchore architecture

Slide 34

Slide 34 text

October 17, 2018 October 17, 2018 Anchore navigator

Slide 35

Slide 35 text

October 17, 2018 October 17, 2018 Anchore cli

Slide 36

Slide 36 text

October 17, 2018 October 17, 2018 Anchore cli

Slide 37

Slide 37 text

October 17, 2018 October 17, 2018

Slide 38

Slide 38 text

October 17, 2018 October 17, 2018

Slide 39

Slide 39 text

October 17, 2018 October 17, 2018

Slide 40

Slide 40 text

October 17, 2018 October 17, 2018

Slide 41

Slide 41 text

October 17, 2018 October 17, 2018

Slide 42

Slide 42 text

October 17, 2018 October 17, 2018

Slide 43

Slide 43 text

October 17, 2018 October 17, 2018

Slide 44

Slide 44 text

October 17, 2018 October 17, 2018

Slide 45

Slide 45 text

October 17, 2018 October 17, 2018 NVD vulnerabilities https://github.com/linxack/nvdparser

Slide 46

Slide 46 text

October 17, 2018 October 17, 2018 NVD vulnerabilities

Slide 47

Slide 47 text

October 17, 2018 October 17, 2018 Vulners

Slide 48

Slide 48 text

October 17, 2018 October 17, 2018

Slide 49

Slide 49 text

October 17, 2018 October 17, 2018 Vulners

Slide 50

Slide 50 text

October 17, 2018 October 17, 2018

Slide 51

Slide 51 text

October 17, 2018 October 17, 2018 Vulners

Slide 52

Slide 52 text

October 17, 2018 October 17, 2018 Vulners

Slide 53

Slide 53 text

October 17, 2018 October 17, 2018 Vulners

Slide 54

Slide 54 text

October 17, 2018

Slide 55

Slide 55 text

October 17, 2018 Thank You Supporters

Slide 56

Slide 56 text

October 17, 2018 Meet me in the Slack channel for Q&A bit.ly/addo-slack