Copy Fail Blocker

copy-fail-blocker.md

Copy Fail Blocker

• Copy Fail Blocker
  • Overview
  • Issue
  • Resources
  • Check Vulnerability
  • Deploy Copy Fail Blocker Viability
  • Deploy Copy Fail Blocker
  • Remove Copy Fail Blocker

Overview

• BPF-LSM mitigation for the copy fail vulnerability (CVE-2024-3174) in the Linux kernel
• DaemonSet attaches single BPF-LSM program to the socket_create hook on every node
• GitHub: copy-fail-blocker

Issue

• AWS haven't yet release an AMI that includes an upstream fix
• upgrading to latest AMI version still has container version kernel6.12-6.12.79-101.147.amzn2023 which is still vulnerable

Resources

• AWS Containers Roadmap
• ALSC Status updates

Check Vulnerability

# ssh into any EKS node

# check for copy fail vulnerability
python3 -c '
import socket
try:
    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)
    print("FAIL: AF_ALG socket created - not protected")
except OSError as e:
    print("OK:", e)'

# FAIL: AF_ALG socket created - not protected

Deploy Copy Fail Blocker Viability

# check what BPF LSM is compiled in
grep CONFIG_BPF_LSM /boot/config-$(uname -r)
# CONFIG_BPF_LSM=y

# check bpf is in active LSM stack
cat /sys/kernel/security/lsm
# lockdown,capability,landlock,yama,safesetid,selinux,bpf,ima

Deploy Copy Fail Blocker

# deploy copy fail blocker
k  apply -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml

# verify rollout
k -n kube-system rollout status daemonset/copy-fail-blocker

# verify copy fail is blocked
python3 -c '
import socket
try:
    socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)
    print("FAIL: AF_ALG socket created - not protected")
except OSError as e:
    print("OK:", e)'

# OK: [Errno 1] Operation not permitted

Remove Copy Fail Blocker

• remove once an AMI has been released with fix

# remove copy fail blocker
k delete -f https://raw.githubusercontent.com/cozystack/copy-fail-blocker/v0.2.1/manifests/copy-fail-blocker.yaml