Description<\/p>\n
The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking
\nthe tree with FTS and calling `lchown` and `chmod` on each entry’s full pathname while running with an
\neffective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the
\nentry, and the trees being walked are owned and writable by the untrusted topology user.<\/p>\n
A tenant running code on a supervisor node could therefore replace an intermediate directory component with
\na symbolic link between classification and the privileged operation, redirecting the root-owned `lchown` or
\n`chmod` at an arbitrary file on the host. The operation is repeatable at will, since crashing a worker
\nforces a relaunch and blob updates re-run the walk, so a failed attempt costs the attacker nothing.<\/p>\n
This crosses the boundary that `supervisor.run.worker.as.user` and container isolation are intended to
\nenforce. It is the same defect class as the Hadoop container-executor issues from which this code derives.<\/p>\n
Mitigation<\/p>\n
Upgrade to 3.1.0, where the privileged walk operates on file descriptors it has already stat’d rather than
\non pathnames re-resolved at call time.<\/p>\n
Users who cannot upgrade immediately should not run untrusted topology code on supervisors configured with
\n`supervisor.run.worker.as.user`, since the launcher is the boundary being crossed. Note that the launcher
\nmust be rebuilt and reinstalled after upgrading; replacing the Java artifacts alone is not sufficient.<\/p>\n
Credit<\/p>\n
The ASF — found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm.<\/p>\n","protected":false},"excerpt":{"rendered":"
Description<\/p>\n
The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking
\nthe tree with FTS and calling `lchown` and `chmod` on each entry’s full pathnam<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-22314","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/22314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}