The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
\nthat scans container processes for runtime fingerprinting. When scanning a
\ncontainer, the coordinator:<\/p>\n
1. **fork()s** a child process
\n2. **setns()** into the target container’s PID and mount namespaces
\n3. **fchdir()** back to an orphaned FD pointing at the extractor’s own root
\n filesystem (where `\/crio.sock` is hostPath-mounted)
\n4. Calls **only `seteuid(target_uid)`** \u2014 changing the effective UID but leaving
\n the **real UID and saved-set-UID at 0** and **retaining the permitted
\n capability set**
\n5. The `check_no_privileged_perms()` guard inspects only the Effective capability
\n set (so it passes), and is **skipped entirely when the target runs as uid 0**
\n6. The `VersionExecutable` fingerprint invokes `fpr_kind_executable` with
\n `process.command_line[0]` \u2014 the target’s argv[0], read from
\n `\/proc\/\/cmdline` and **fully controlled by the workload**
\n7. `fpr_kind_executable` calls `exec.Command(executable, “–version”).Output()`
\n \u2014 executing the **workload’s own binary** inside the workload’s mount
\n namespace while **ruid=0 in the host user namespace**<\/p>\n
The executed process can call `setuid(0)` to restore full root with
\n`CAP_SYS_ADMIN`, and inherits the orphaned cwd which resolves into the extractor
\ncontainer’s filesystem containing the host CRI-O socket.<\/p>\n
## Affected Code<\/p>\n
### 1. Insufficient privilege drop (Rust \u2014 extractor coordinator)<\/p>\n
**File:** `extractor\/src\/insights_runtime_extractor.rs`<\/p>\n
“`rust
\n\/\/ Lines 139-146 \u2014 seteuid-only drop, guard skipped for root containers
\njoin_process_namespaces(process.pid)?;
\nchange_dir(current_dir);
\nswitch_user(*process.uid)?;
\nif *process.uid != 0 {
\n perms::check_no_privileged_perms()
\n .expect(“Must not have privileged permissions to run fingerprints”);
\n}
\nfingerprint::run_fingerprints(&config, out_dir, &process);
\n“`<\/p>\n
“`rust
\n\/\/ Lines 182-185 \u2014 only effective UID changed; ruid\/suid stay 0
\nfn switch_user(uid: u32) -> Result {
\n debug!(“… Becoming user: {uid}”);
\n seteuid(uid.into()).map_err(|e| ScannerError::Errno(e))
\n}
\n“`<\/p>\n
### 2. Execution of untrusted binary (Go \u2014 fingerprint)<\/p>\n
**File:** `fingerprints\/pkg\/utils\/file.go`<\/p>\n
“`go
\n\/\/ Lines 75-80 \u2014 executes a path taken verbatim from workload’s argv[0]
\nfunc GetExecutableVersionOutput(executable string) (string, error) {
\n out, err := exec.Command(executable, “–version”).Output()
\n if err != nil {
\n return “”, err
\n }
\n return string(out), nil
\n}
\n“`<\/p>\n
### 3. Workload-controlled path forwarded (Rust \u2014 version_executable)<\/p>\n
**File:** `version_executable.rs`<\/p>\n
“`rust
\n\/\/ Lines 29-34 \u2014 workload-controlled command_line[0] forwarded to fingerprint
\nreturn Some(vec![
\n fpr_kind_executable,
\n out_dir.to_string(),
\n String::from(&process.command_line[0]),
\n String::from(&version_executable.runtime_kind_name),
\n]);
\n“`<\/p>\n
## Attack Pattern<\/p>\n
**Attacker:** Any tenant able to schedule a pod (unprivileged, any namespace)
\n**Victim:** The node running the insights-runtime-extractor DaemonSet
\n**Trigger:** Automatic \u2014 the DaemonSet scans all container processes on the node<\/p>\n
**Attack sequence:**<\/p>\n
1. Attacker creates a pod whose process name matches a configured
\n versioned-executable pattern (`node`, `python`, `python3`, `MainThread`,
\n or contains `java`)
\n2. The pod’s main binary (at the path matching argv[0]) is a malicious
\n executable that calls `setuid(0)` to restore root
\n3. When the insights operator triggers a scan, the DaemonSet forks, enters the
\n attacker’s mount namespace, and executes the attacker’s binary with ruid=0
\n4. The attacker’s code regains full root with `CAP_SYS_ADMIN` in the host user
\n namespace
\n5. The inherited cwd contains the host CRI-O socket \u2192 full node compromise<\/p>\n","protected":false},"excerpt":{"rendered":"
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)
\nthat scans container processes for runtime fingerprinting. When scanning a
\ncontainer, the coordinator:<\/p>\n
1. **fork()s** a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39014","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}