Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rule(falco_rules): Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) #1877

Merged
merged 3 commits into from
Feb 11, 2022
Merged

rule(falco_rules): Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) #1877

merged 3 commits into from
Feb 11, 2022

Conversation

darryk10
Copy link
Contributor

@darryk10 darryk10 commented Jan 28, 2022 •
edited
Loading

Polkit pkexec Local Privilege Escalation Vulnerability (CVE-2021-4034)

Co-authored-by: javery-sysdig jason.avery@sysdig.com

Signed-off-by: darryk10 stefano.chierici@sysdig.com

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

If contributing rules or changes to rules, please make sure to also uncomment one of the following line:

/kind rule-update

/kind rule-create

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area rules

/area tests

/area proposals

What this PR does / why we need it:
This rule detects an attempt to exploit a privilege escalation vulnerability in Polkit's pkexec. By running specially crafted code, a local user can leverage this flaw to gain root privileges on a compromised system. Reference: https://seclists.org/oss-sec/2022/q1/80
Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

rule(Polkit Local Privilege Escalation Vulnerability): new rule created to detect CVE-2021-4034

@darryk10
Added new Rule Polkit Local Privilege Escalation Vulnerability (CVE-2…
d958fd7 
…021-4034)

Co-authored-by: javery-sysdig <jason.avery@sysdig.com>

Signed-off-by: Stefano <stefano.chierici@sysdig.com>
@poiana poiana requested review from Kaizhe and mfdii January 28, 2022 11:28
@poiana poiana added the size/S label Jan 28, 2022
@darryk10 darryk10 changed the title Added new Rule Polkit Local Privilege Escalation Vulnerability (CVE-2… New Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034 Jan 28, 2022
@darryk10 darryk10 changed the title New Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034 New Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) Jan 28, 2022
@darryk10 darryk10 changed the title New Rule Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) rule(falco_rules): Polkit Local Privilege Escalation Vulnerability (CVE-2021-4034) Jan 28, 2022
jhoos
jhoos reviewed Jan 28, 2022
View reviewed changes
rules/falco_rules.yaml Outdated Show resolved Hide resolved
@darryk10
Fixed rule condition
973fa44 
Signed-off-by: darryk10 <stefano.chierici@sysdig.com>
@leogr
Copy link
Member

leogr commented Jan 31, 2022

/milestone 0.32.0

@poiana poiana added this to the 0.32.0 milestone Jan 31, 2022
Kaizhe
Kaizhe previously approved these changes Jan 31, 2022
View reviewed changes
@poiana poiana added the lgtm label Jan 31, 2022
@poiana
Copy link
Contributor

poiana commented Jan 31, 2022

LGTM label has been added.

Git tree hash: 43f41078cdec781081e9f4c261960312c7f29619

leogr
leogr reviewed Feb 2, 2022
View reviewed changes
Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've found an issue in the output, otherwise SGMT.

I'm also a bit concerned about false positives since this rule triggers just every time pkexec is called without args.

rules/falco_rules.yaml Outdated Show resolved Hide resolved
@darryk10 @leogr
Update rules/falco_rules.yaml
3e0f04f 
Signed-off-by: darryk10 stefano.chierici@sysdig.com

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
@poiana poiana removed the lgtm label Feb 2, 2022
@poiana poiana requested a review from Kaizhe February 2, 2022 14:59
@Kaizhe
Copy link
Contributor

Kaizhe commented Feb 11, 2022 •
edited
Loading

I've found an issue in the output, otherwise SGMT.

I'm also a bit concerned about false positives since this rule triggers just every time pkexec is called without args.

According to the fix, the pkexe will return error if runs without argument. With that said, executing it without argument is a suspicious thing. (of course, people who first time run pkexe may trigger the alert)

leogr
leogr approved these changes Feb 11, 2022
View reviewed changes
Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Feb 11, 2022
@poiana
Copy link
Contributor

poiana commented Feb 11, 2022

LGTM label has been added.

Git tree hash: 9930421d1be81c2d9611a39c028c2d34a4d05f12

jasondellaluce
jasondellaluce approved these changes Feb 11, 2022
View reviewed changes
Copy link
Contributor

@jasondellaluce jasondellaluce left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Feb 11, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: darryk10, jasondellaluce, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit b992557 into falcosecurity:master Feb 11, 2022
@jasondellaluce jasondellaluce modified the milestones: 0.32.0, 0.31.1 Mar 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@anthony-alessi-acquia anthony-alessi-acquia anthony-alessi-acquia left review comments

@jhoos jhoos jhoos left review comments

@jasondellaluce jasondellaluce jasondellaluce approved these changes

@leogr leogr leogr approved these changes

@mfdii mfdii Awaiting requested review from mfdii

@Kaizhe Kaizhe Awaiting requested review from Kaizhe

Assignees

@Kaizhe Kaizhe

@leogr leogr

@jasondellaluce jasondellaluce

Labels
approved area/rules dco-signoff: yes kind/rule-create lgtm release-note size/S
Projects
None yet
Milestone
0.31.1
Development

Successfully merging this pull request may close these issues.
7 participants
@darryk10 @leogr @poiana @Kaizhe @jhoos @jasondellaluce @anthony-alessi-acquia