CVE-2021-3602 (Markdown, published 2022-03-03T19:15Z)
Description: value: An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-212 \u2014 Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Repository: https://github.com/containers/buildah
Files changed:
chroot/run.go
docs/buildah-bud.md
docs/buildah-from.md
docs/buildah-run.md
Commit message: chroot: fix environment value leakage to intermediate processes

Blake Burkhart reports that when running processes using "chroot"
isolation, the process being run can examine the environment of its
immediate parent and grandparent processes (CVE-2021-3602).

When run in a container in a CI/CD environment, the environment may
include sensitive information which was shared with the container in
order to be used only by buildah itself.  The command being executed is
able to read such information.

This patch reduces the set of environment variables passed to these
intermediate processes, from all variables to the one which is used to
control the level of debug logging.  It also corrects a misleading debug
message and expands the description of chroot isolation in man pages.

Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>


Vulnerable code:
	cmd.Env = append([]string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}, os.Environ()...)
	if options.Spec == nil {
	cmd.Env = append([]string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}, os.Environ()...)
	if options.Spec == nil {
	sawUserNS := false
				logrus.Debugf("unable to join user namespace %q, creating a new one", ns.Path)
			sawUserNS = true
	if !sawUserNS {
		logrus.Debugf("user namespace not requested, but creating a new one anyway")
	}
configuration, with *--no-new-keyring* added to its *create*
invocation, with network and UTS namespaces disabled, and IPC, PID,
and user namespaces enabled; the default for unprivileged users), and
*chroot* (an internal wrapper that leans more toward chroot(1) than
container technology).
configuration, with *--no-new-keyring* added to its *create*
invocation, with network and UTS namespaces disabled, and IPC, PID,
and user namespaces enabled; the default for unprivileged users), and
*chroot* (an internal wrapper that leans more toward chroot(1) than
container technology).
*--no-new-keyring* added to its *create* invocation, with network and
UTS namespaces disabled, and IPC, PID, and user namespaces enabled;
the default for unprivileged users), and *chroot* (an internal wrapper
that leans more toward chroot(1) than container technology).

Fixed code:
	cmd.Env = []string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}
	if options.Spec == nil || options.Spec.Process == nil {
	cmd.Env = []string{fmt.Sprintf("LOGLEVEL=%d", logrus.GetLevel())}
	if options.Spec == nil || options.Spec.Process == nil {
				logrus.Debugf("unable to join user namespace, sorry about that")
configuration, with *--no-new-keyring* added to its *create* invocation,
reusing the host's network and UTS namespaces, and creating private IPC, PID,
mount, and user namespaces; the default for unprivileged users), and *chroot*
(an internal wrapper that leans more toward chroot(1) than container
technology, reusing the host's control group, network, IPC, and PID namespaces,
and creating private mount and UTS namespaces, and creating user namespaces
only when they're required for ID mapping).
configuration, with *--no-new-keyring* added to its *create* invocation,
reusing the host's network and UTS namespaces, and creating private IPC, PID,
mount, and user namespaces; the default for unprivileged users), and *chroot*
(an internal wrapper that leans more toward chroot(1) than container
technology, reusing the host's control group, network, IPC, and PID namespaces,
and creating private mount and UTS namespaces, and creating user namespaces
only when they're required for ID mapping).
*--no-new-keyring* added to its *create* invocation, reusing the host's network
and UTS namespaces, and creating private IPC, PID, mount, and user namespaces;
the default for unprivileged users), and *chroot* (an internal wrapper that
leans more toward chroot(1) than container technology, reusing the host's
control group, network, IPC, and PID namespaces, and creating private mount and
UTS namespaces, and creating user namespaces only when they're required for ID
mapping).