High severity security vulnerabilities in nginx:1.18.0 and 1.19.X images

[manpreet712]

With security scan of nginx base image 1.18.0 and 1.19.4 images we are getting the below high vulnerabilities:-

1. A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

2. An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

3. An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.

4)stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

Can these be fixed?

[yosifkit]

https://github.com/docker-library/faq/tree/ebdc26b439b2cc1add1a9dc15c4c0ed0d5c024c8#why-does-my-security-scanner-show-that-an-image-has-cves

1. The only systemd-related thing installed in the image is libsystemd0; systemd does not run in the container, so this vulnerability is non-applicable. Also, the version in Debian Buster, 241-7~deb10u4, is patched (https://security-tracker.debian.org/tracker/CVE-2020-1712); your scanner likely needs to take into account Debian Security information.

2. the ARMv7 memcpy

   This doesn't effect any other architectures. Debian Security marked this as "Minor issue" and so a fix will likely never be available in Debian Buster (https://security-tracker.debian.org/tracker/CVE-2020-6096).

3. Debian version is fixed (https://security-tracker.debian.org/tracker/CVE-2020-11724), but also shouldn't even be installed since the nginx packages come from https://nginx.org/ and so are newer and thus not part of this CVE.

4. Debian Security has marked this as "Too intrusive to backport" (https://security-tracker.debian.org/tracker/CVE-2018-12886) so it will also likely never have a fix in Debian Buster.

$ docker pull nginx:1.18
1.18: Pulling from library/nginx
852e50cd189d: Pull complete 
48b8657f2521: Pull complete 
b4f4d57f1a55: Pull complete 
d8fbe49a7d55: Pull complete 
04e4a40fabc9: Pull complete 
Digest: sha256:2104430ec73de095df553d0c7c2593813e01716a48d66f85a3dc439e050919b3
Status: Downloaded newer image for nginx:1.18
docker.io/library/nginx:1.18
$ docker run -it --rm nginx:1.18 bash
root@25f3aca6ec7f:/# dpkg -l | grep systemd
ii  libsystemd0:amd64         241-7~deb10u4               amd64        systemd utility library
root@25f3aca6ec7f:/# dpkg -l | grep nginx
ii  nginx                     1.18.0-1~buster             amd64        high performance web server
ii  nginx-module-geoip        1.18.0-1~buster             amd64        nginx GeoIP dynamic modules
ii  nginx-module-image-filter 1.18.0-1~buster             amd64        nginx image filter dynamic module
ii  nginx-module-njs          1.18.0.0.4.4-1~buster       amd64        nginx njs dynamic modules
ii  nginx-module-xslt         1.18.0-1~buster             amd64        nginx xslt dynamic module
root@25f3aca6ec7f:/# dpkg -l | grep lua
root@25f3aca6ec7f:/# dpkg -l | grep gcc
ii  gcc-8-base:amd64          8.3.0-6                     amd64        GCC, the GNU Compiler Collection (base package)
ii  libgcc1:amd64             1:8.3.0-6                   amd64        GCC support library

[thresheek]

Fixed in nginx:1.21.4

[thresheek]

Fixed in nginx:1.20.2

Closing this one as both mainline and stable images now don't exhibit this problem.