Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

When you mount a folder in Docker, the virtual machine manager (VMM) uses virtio-fs, a file server that runs on the host. The first time a guest accesses a path, it sends a lookup to the server, which responds with the nodeid. Each time the file is queried again, the same nodeid is used for caching. As a result, the server never has to find the file. This functionality leads to the bug.

In order to find it, it first tries the inode reference value that was originally returned. If this fails, then it uses macOS volfs with the path string from when the file was first loaded. The bug is that this path is trusted for the string with a lookup. Thus, the nodeid is pointing to something that was not properly verified. This is the classic switheroo attack.

Here's how the exploit works:

1. A container is created with a file system mount.
2. Create a folder within the mount with a file with the same name as the file you want to read/write to.
3. Create a file within the mount. Keep it open with a reference to the nodeid.
4. Delete the file, then delete the folder. The volfs path gets updated with it.
5. Make a symlink to the original folder. Point this to a location outside of the container.
6. Read or write through the handle on step 3.

Symlinks, TOCTOU, and exploits go together like peas in a pod. A good article for a fairly simple bug. I loved how short it was!