CVE-2021-20182
📋 TL;DR
This CVE describes a privilege escalation vulnerability in OpenShift's docker-builder container where the build container runs with high privileges using chroot instead of runc. Attackers who gain access to the build container can access raw node devices to escalate privileges to cluster admin level. This affects OpenShift 4 deployments using the vulnerable ose-docker-builder component.
💻 Affected Systems
- openshift4/ose-docker-builder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full cluster compromise allowing attackers to access all cluster resources, modify configurations, exfiltrate sensitive data, and disrupt operations.
Likely Case
Privilege escalation from build container to node-level access, potentially leading to lateral movement within the cluster.
If Mitigated
Limited impact if proper network segmentation, least privilege, and monitoring are implemented.
🎯 Exploit Status
Exploitation requires initial access to the build container, but privilege escalation is straightforward once inside.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenShift 4.7.13, 4.6.23, and 4.5.31
Vendor Advisory: https://access.redhat.com/errata/RHSA-2021:0338
Restart Required: Yes
Instructions:
1. Update OpenShift cluster to patched version. 2. Update all builder nodes. 3. Restart affected containers and nodes. 4. Verify all components are running patched versions.
🔧 Temporary Workarounds
Restrict Build Container Access
linuxLimit who can create and access build containers using RBAC and network policies.
oc adm policy add-role-to-user edit <username> -n <namespace>
oc create networkpolicy restrict-builds --pod-selector='name=docker-builder' --ingress=''
Use Runc Instead of Chroot
linuxConfigure builder to use runc isolation instead of chroot where possible.
oc edit buildconfig <buildconfig-name>
Set 'runPolicy' to 'Serial' and ensure proper isolation
🧯 If You Can't Patch
- Implement strict network segmentation to isolate build containers from production systems
- Apply least privilege principles to build service accounts and restrict raw device access
🔍 How to Verify
Check if Vulnerable:
Check OpenShift version: oc version, then verify if version is below 4.7.13, 4.6.23, or 4.5.31Check Version:
oc version --client && oc versionVerify Fix Applied:
Verify cluster version is at or above patched versions and check builder container configuration uses proper isolation📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to build containers
- Unusual privilege escalation events in container logs
- Suspicious raw device access from build containers
Network Indicators:
- Unexpected network connections from build containers to cluster nodes
- Suspicious traffic patterns from builder pods
SIEM Query:
source="openshift" AND (event="container_escape" OR event="privilege_escalation") AND container_name="*docker-builder*"